Play interactive tour

Edit tour

Windows Analysis Report FedEx TRACKING DETAILS.exe

Overview

General Information

Sample Name:	FedEx TRACKING DETAILS.exe
Analysis ID:	532861
MD5:	32414d4cae15c3a8063bf1251346533c
SHA1:	3e92cca40b5b3bde11265ea773e77e0cd2432f96
SHA256:	d6b4f7ba99b492e9b2382b51f6c49b32e86cc81b7fc6c93313f5962de4b910bd
Tags:	exeFedExFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

Antivirus detection for URL or domain

Multi AV Scanner detection for domain / URL

Writes to foreign memory regions

Machine Learning detection for sample

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Creates a thread in another existing process (thread injection)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to call native functions

Contains functionality for execution timing, often used to detect debuggers

AV process strings found (often used to terminate AV products)

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

FedEx TRACKING DETAILS.exe (PID: 6348 cmdline: "C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe" MD5: 32414D4CAE15C3A8063BF1251346533C)

logagent.exe (PID: 3144 cmdline: C:\Windows\System32\logagent.exe MD5: E2036AC444AB4AD91EECC1A80FF7212F)

WerFault.exe (PID: 4848 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.hdetpnipa.xyz/a34b/"], "decoy": ["mesonarte.com", "eksiwakun9.xyz", "dustcollectionconsultant.com", "heliosarchitecture.com", "chinaanalysisgroup.com", "nimbinhillshemp.com", "ychain.biz", "mountshastaart.com", "monstermangoloco.com", "bodhiandbear.com", "rootednft.xyz", "metayema.com", "zw21.xyz", "criccketworld.com", "segurobarato.net", "ananyacap.com", "momo-momo.xyz", "ezrealestatedeals.com", "ghrde.xyz", "idimol.com", "pcthspoe.xyz", "thewhiteswanharringworth.com", "che8760.com", "85111280.xyz", "apteka-magnolia.com", "proach.online", "portfolioabeckford.com", "affilinvest.com", "subspank.xyz", "odessamadrecoffeehouse.com", "onetrade.biz", "tianfuhg.com", "kibtitalikeniwenti.com", "terriblearttours.com", "saudirelief.com", "metacourting.xyz", "kimera.blue", "mgpsfm.com", "metawzrd.com", "veahhiodl.xyz", "alimasurfhotel.com", "sirensandiego.com", "gd-hxgg.com", "aurorarift.com", "clingbee.com", "zettavisor2021.xyz", "gregoryryankramer.art", "robertsonfandc.com", "sociedadgeograficacafe.com", "emilyhkeefer.com", "v-hush.com", "judithtuttle.xyz", "itbrandlink.com", "carrybicycles.com", "storge-evolution.com", "socnhhpa.xyz", "victorzark.com", "ghettoguy.com", "redtruckguy.com", "jeanmariewallendorf.com", "ocpdtel.xyz", "democracies.online", "bw529twonineh5.world", "chinhdohuyenthoai.xyz"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
7.0.logagent.exe.725b0000.11.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.11.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.11.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.8.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.8.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.8.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.8.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.8.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.8.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.6c0000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.6c0000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.6c0000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.725b0000.3.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.725b0000.3.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.725b0000.3.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.2.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.2.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.2.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.7.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.7.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.7.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.725b0000.3.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.725b0000.3.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.725b0000.3.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.4.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.4.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x9908:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x156b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x151a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x157b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1592f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa59a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1441c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb293:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b927:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c92a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.4.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18849:$sqlite3step: 68 34 1C 7B E1 0x1895c:$sqlite3step: 68 34 1C 7B E1 0x18878:$sqlite3text: 68 38 2A 90 C5 0x1899d:$sqlite3text: 68 38 2A 90 C5 0x1888b:$sqlite3blob: 68 53 D8 7F 8C 0x189b3:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.7.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.7.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.7.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.3.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.3.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.3.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.1.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.1.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xa74c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xa9c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x164f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15fe5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x165fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x16773:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xb3de:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15260:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xc0d7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1c76b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1d76e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.1.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1968d:$sqlite3step: 68 34 1C 7B E1 0x197a0:$sqlite3step: 68 34 1C 7B E1 0x196bc:$sqlite3text: 68 38 2A 90 C5 0x197e1:$sqlite3text: 68 38 2A 90 C5 0x196cf:$sqlite3blob: 68 53 D8 7F 8C 0x197f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.725b0000.11.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.725b0000.11.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xb34c:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xb5c6:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x170f9:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x16be5:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x171fb:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x17373:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xbfde:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x15e60:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xccd7:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1d36b:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1e36e:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.725b0000.11.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x1a28d:$sqlite3step: 68 34 1C 7B E1 0x1a3a0:$sqlite3step: 68 34 1C 7B E1 0x1a2bc:$sqlite3text: 68 38 2A 90 C5 0x1a3e1:$sqlite3text: 68 38 2A 90 C5 0x1a2cf:$sqlite3blob: 68 53 D8 7F 8C 0x1a3f7:$sqlite3blob: 68 53 D8 7F 8C
7.0.logagent.exe.6c0000.4.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.0.logagent.exe.6c0000.4.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.0.logagent.exe.6c0000.4.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
7.2.logagent.exe.6c0000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
7.2.logagent.exe.6c0000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8b08:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d82:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x148b5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x143a1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x149b7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14b2f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x979a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1361c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa493:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1ab27:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1bb2a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
7.2.logagent.exe.6c0000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17a49:$sqlite3step: 68 34 1C 7B E1 0x17b5c:$sqlite3step: 68 34 1C 7B E1 0x17a78:$sqlite3text: 68 38 2A 90 C5 0x17b9d:$sqlite3text: 68 38 2A 90 C5 0x17a8b:$sqlite3blob: 68 53 D8 7F 8C 0x17bb3:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 43 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.hdetpnipa.xyz/a34b/"], "decoy": ["mesonarte.com", "eksiwakun9.xyz", "dustcollectionconsultant.com", "heliosarchitecture.com", "chinaanalysisgroup.com", "nimbinhillshemp.com", "ychain.biz", "mountshastaart.com", "monstermangoloco.com", "bodhiandbear.com", "rootednft.xyz", "metayema.com", "zw21.xyz", "criccketworld.com", "segurobarato.net", "ananyacap.com", "momo-momo.xyz", "ezrealestatedeals.com", "ghrde.xyz", "idimol.com", "pcthspoe.xyz", "thewhiteswanharringworth.com", "che8760.com", "85111280.xyz", "apteka-magnolia.com", "proach.online", "portfolioabeckford.com", "affilinvest.com", "subspank.xyz", "odessamadrecoffeehouse.com", "onetrade.biz", "tianfuhg.com", "kibtitalikeniwenti.com", "terriblearttours.com", "saudirelief.com", "metacourting.xyz", "kimera.blue", "mgpsfm.com", "metawzrd.com", "veahhiodl.xyz", "alimasurfhotel.com", "sirensandiego.com", "gd-hxgg.com", "aurorarift.com", "clingbee.com", "zettavisor2021.xyz", "gregoryryankramer.art", "robertsonfandc.com", "sociedadgeograficacafe.com", "emilyhkeefer.com", "v-hush.com", "judithtuttle.xyz", "itbrandlink.com", "carrybicycles.com", "storge-evolution.com", "socnhhpa.xyz", "victorzark.com", "ghettoguy.com", "redtruckguy.com", "jeanmariewallendorf.com", "ocpdtel.xyz", "democracies.online", "bw529twonineh5.world", "chinhdohuyenthoai.xyz"]}

Multi AV Scanner detection for submitted file

Show sources

Source: FedEx TRACKING DETAILS.exe	Virustotal: Detection: 36%			Perma Link
Source: FedEx TRACKING DETAILS.exe	ReversingLabs: Detection: 51%

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

Antivirus detection for URL or domain

Show sources

Source: www.hdetpnipa.xyz/a34b/

Avira URL Cloud: Label: phishing

Multi AV Scanner detection for domain / URL

Show sources

Source: www.hdetpnipa.xyz/a34b/

Virustotal: Detection: 9%

Perma Link

Machine Learning detection for sample

Show sources

Source: FedEx TRACKING DETAILS.exe

Joe Sandbox ML: detected

Source: 1.3.FedEx TRACKING DETAILS.exe.26e1534.338.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.291.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1914.140.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0fb8.93.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c975c.64.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c95f8.303.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1104.107.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd434.350.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de008.143.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c53cc.145.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd954.118.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4014.184.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d858c.229.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb8c4.81.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1c44.353.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1348.39.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c45dc.85.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.11.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de3c4.151.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6ecc.218.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1104.108.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d421c.193.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4008.14.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd3f0.111.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb8c4.79.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2eac.171.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4014.182.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e2180.55.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0fb8.90.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e74.106.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5504.154.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d91b4.253.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.6c0000.8.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e4008.202.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0fb8.321.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca2bc.309.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9ca8.51.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9494.258.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e130c.333.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9ca8.54.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd43c.356.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0fd0.47.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2c04.162.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc0b4.22.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26db95c.311.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c527c.138.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e70.99.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c11a0.61.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de3c4.148.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de758.159.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca1c8.15.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c93bc.50.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd3f4.7.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d3840.84.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ad4.238.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e4008.200.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dffc8.172.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9434.285.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de758.156.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2104.74.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dddf4.126.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d39ac.179.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dffc8.170.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd3f4.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e10e4.331.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb5dc.77.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccd98.322.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1804.49.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc5dc.318.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.298.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4160.25.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1914.139.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d421c.191.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.297.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1d94.192.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1804.52.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9e2c.299.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6d44.214.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9128.40.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1bb4.149.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9434.287.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd440.354.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c92b0.267.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0008.319.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c11a0.60.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd3f0.109.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2eac.168.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9c84.286.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c93bc.48.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.2.logagent.exe.725b0000.3.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c51a0.121.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d36c4.175.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d149c.117.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb6b8.20.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5040.115.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca2bc.310.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9acc.275.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9c84.289.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0008.317.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1d94.195.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6ecc.217.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ed4.245.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da3b4.68.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd1a0.340.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ddef4.132.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e0fb8.323.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bee4c.18.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd954.116.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9128.38.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0cf0.33.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dc210.28.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d18b4.131.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc5dc.316.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d18b4.133.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5288.17.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccd98.320.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd08c.337.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d68d4.204.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd2b4.345.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d77e8.11.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1534.339.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ca1c8.16.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cfffc.313.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6cd0.209.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1d74.66.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb6b8.21.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1094.327.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.0.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1348.41.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4d98.91.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d7438.222.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.2.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e3840.314.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1094.325.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd2dc.102.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.7.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1e24.155.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cc0b4.24.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9b24.283.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0fd0.46.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6cd0.210.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bc0d0.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c51a0.122.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2ff0.4.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5278.130.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9dd4.295.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1c44.355.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bdfc0.13.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9b24.281.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d858c.230.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c527c.137.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5288.19.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd2b4.344.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1ad8.187.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e3840.315.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c95f8.305.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9508.293.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6618.181.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d99e8.268.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccf78.332.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dc210.26.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c45dc.86.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c53cc.147.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd43c.358.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d6d44.212.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0008.87.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c903c.255.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cce68.324.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6178.173.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e1ad8.185.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2278.78.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd1a0.342.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e70.97.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da00c.304.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d68d4.206.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0008.88.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26bde24.2.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e130c.335.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26de008.141.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd2dc.101.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.273.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c0cf0.32.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4008.12.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4d98.89.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c975c.62.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d52a4.201.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c91ac.261.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d77e8.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c92b0.269.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd1dc.95.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d7438.220.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ad4.237.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dfbf8.166.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d17c8.124.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd440.352.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9494.256.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dfbf8.164.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cb5dc.75.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8008.224.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dddf4.125.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6178.174.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2104.76.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1d74.63.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c91ac.262.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2278.80.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.3.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d36c4.176.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.725b0000.1.unpack	Avira: Label: TR/Crypt.Morphine.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ccf78.334.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8ed4.246.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d39ac.180.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c2ff0.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26dd1dc.92.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e175c.341.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.274.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.279.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9acc.277.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e10e4.329.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.0.logagent.exe.6c0000.4.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d2c04.165.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c4e74.105.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0f64.36.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d8008.226.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1e24.157.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9e2c.301.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d3840.83.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d99e8.270.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d9dd4.292.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e2180.53.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d1bb4.146.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d52a4.198.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5278.129.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5504.153.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d17c8.123.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd08c.336.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cce68.326.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d4160.23.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c903c.257.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26db95c.312.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c5040.113.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d0f64.37.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26ddef4.134.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26cd434.348.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d149c.114.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da00c.307.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 7.2.logagent.exe.6c0000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26e175c.343.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26da3b4.65.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c9384.280.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26d91b4.250.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.3.FedEx TRACKING DETAILS.exe.26c6618.183.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: FedEx TRACKING DETAILS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source:	Binary string: wininet.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.377390699.000000000543C000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377407261.000000000543D000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: logagent.exe, logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000B.00000002.392961331.00000000032F2000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: logagent.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wsock32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.hdetpnipa.xyz/a34b/

Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312773374.00000000007F8000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.309668822.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: WerFault.exe, 0000000B.00000002.393477883.0000000005410000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
Source: Amcache.hve.11.dr	String found in binary or memory: http://upx.sf.net
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312773374.00000000007F8000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.309668822.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/C
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312794774.0000000000832000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/y4mPZtA9xPxqg1XkAX9-qUmR9UIvDv4jsOqvEGGW7e_sHrucIbMm3Gtnd2oRX03KcuO
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/y4mTGtN2XEyFxr4Fwg2GfGDYA-weizJsEgCfvnFlKm_xwhWQiYk4SVd3YN1FLBVj9kD
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	String found in binary or memory: https://3eie8a.sn.files.1drv.com/y4mwmaWo75uzUwtwpwSnt0PfQZClqYm-BqTi81xEEYBIo3hzrTU99nIAl5l4jRjpvu3
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.312794774.0000000000832000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/B&resid=C34B41C1B35825CB%21140&authkey=AN9sEgEIgUt16GA
Source: FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	String found in binary or memory: https://onedrive.live.com/download?cid=C34B41C1B35825CB&resid=C34B41C1B35825CB%21140&authkey=AN9sEgE

Source: unknown

DNS traffic detected: queries for: onedrive.live.com

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Source: FedEx TRACKING DETAILS.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI

Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: C:\Windows\SysWOW64\logagent.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048020A8	7_2_048020A8
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474841F	7_2_0474841F
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1002	7_2_047F1002
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0	7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B090	7_2_0474B090
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04730D20	7_2_04730D20
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120	7_2_04754120
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473F900	7_2_0473F900
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04802D07	7_2_04802D07
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474D5E0	7_2_0474D5E0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04801D55	7_2_04801D55
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581	7_2_04762581
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048022AE	7_2_048022AE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04756E30	7_2_04756E30
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04802EF7	7_2_04802EF7
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04801FF1	7_2_04801FF1
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04802B28	7_2_04802B28
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FDBD2	7_2_047FDBD2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476EBB0	7_2_0476EBB0

Source: C:\Windows\SysWOW64\logagent.exe

Code function: String function: 0473B150 appears 35 times

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779860 NtQuerySystemInformation,LdrInitializeThunk,	7_2_04779860
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779660 NtAllocateVirtualMemory,LdrInitializeThunk,	7_2_04779660
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047796E0 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_047796E0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477B040 NtSuspendThread,	7_2_0477B040
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779840 NtDelayExecution,	7_2_04779840
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779820 NtEnumerateKey,	7_2_04779820
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047798F0 NtReadVirtualMemory,	7_2_047798F0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047798A0 NtWriteVirtualMemory,	7_2_047798A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779560 NtWriteFile,	7_2_04779560
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779950 NtQueueApcThread,	7_2_04779950
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779540 NtReadFile,	7_2_04779540
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477AD30 NtSetContextThread,	7_2_0477AD30
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779520 NtWaitForSingleObject,	7_2_04779520
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779910 NtAdjustPrivilegesToken,	7_2_04779910
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047795F0 NtQueryInformationFile,	7_2_047795F0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047799D0 NtCreateProcessEx,	7_2_047799D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047795D0 NtClose,	7_2_047795D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047799A0 NtCreateSection,	7_2_047799A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779670 NtQueryInformationProcess,	7_2_04779670
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A50 NtCreateFile,	7_2_04779A50
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779650 NtQueryValueKey,	7_2_04779650
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A20 NtResumeThread,	7_2_04779A20
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779610 NtEnumerateValueKey,	7_2_04779610
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A10 NtQuerySection,	7_2_04779A10
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A00 NtProtectVirtualMemory,	7_2_04779A00
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047796D0 NtCreateKey,	7_2_047796D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779A80 NtOpenDirectoryObject,	7_2_04779A80
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779770 NtSetInformationFile,	7_2_04779770
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477A770 NtOpenThread,	7_2_0477A770
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779760 NtOpenProcess,	7_2_04779760
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779730 NtQueryVirtualMemory,	7_2_04779730
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477A710 NtOpenProcessToken,	7_2_0477A710
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779710 NtQueryInformationToken,	7_2_04779710
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779B00 NtSetValueKey,	7_2_04779B00
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779FE0 NtCreateMutant,	7_2_04779FE0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477A3B0 NtGetContextThread,	7_2_0477A3B0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047797A0 NtUnmapViewOfSection,	7_2_047797A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04779780 NtMapViewOfSection,	7_2_04779780

Source: FedEx TRACKING DETAILS.exe

Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Section loaded: amsiproxy.dll			Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Section loaded: amsiproxy.dll			Jump to behavior

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page no access	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B0000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725B1000 page read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: 725E0000 page read and write	Jump to behavior

Source: FedEx TRACKING DETAILS.exe	Virustotal: Detection: 36%
Source: FedEx TRACKING DETAILS.exe	ReversingLabs: Detection: 51%

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

File read: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Jump to behavior

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe "C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe"
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe
Source: C:\Windows\SysWOW64\logagent.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe	Jump to behavior

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Ipknvfrclgulizdtylbxizfhvowtamb[1]

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC41.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@4/7@2/0

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3144

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source:	Binary string: wininet.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000B.00000003.377390699.000000000543C000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377407261.000000000543D000.00000004.00000001.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: logagent.exe, logagent.exe, 00000007.00000000.369531996.0000000004710000.00000040.00000001.sdmp, logagent.exe, 00000007.00000000.369661210.000000000482F000.00000040.00000001.sdmp, WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000B.00000002.392961331.00000000032F2000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdbk source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: oleaut32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp
Source:	Binary string: logagent.pdb source: WerFault.exe, 0000000B.00000003.381177211.0000000005781000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000B.00000003.381205503.0000000005900000.00000004.00000040.sdmp
Source:	Binary string: wsock32.pdb source: WerFault.exe, 0000000B.00000003.381217300.0000000005907000.00000004.00000040.sdmp

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Code function: 1_3_02641752 push edx; ret		1_3_02641761
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0478D0D1 push ecx; ret		7_2_0478D0E4

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\SysWOW64\logagent.exe	RDTSC instruction interceptor: First address: 00000000006C9904 second address: 00000000006C990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\logagent.exe	RDTSC instruction interceptor: First address: 00000000006C9B7E second address: 00000000006C9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 7_2_04776DE6 rdtsc

7_2_04776DE6

Source: C:\Windows\SysWOW64\logagent.exe

Process information queried: ProcessInformation

Jump to behavior

Source: Amcache.hve.11.dr	Binary or memory string: VMware
Source: Amcache.hve.11.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.
Source: WerFault.exe, 0000000B.00000002.393404168.00000000053F0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWx!B
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.11.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.11.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.11.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.11.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.11.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 0000000B.00000003.390796145.000000000540E000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000002.393477883.0000000005410000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.11.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.11.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.11.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.11.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.11.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.11.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 7_2_04776DE6 rdtsc

7_2_04776DE6

Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F2073 mov eax, dword ptr fs:[00000030h]	7_2_047F2073
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475746D mov eax, dword ptr fs:[00000030h]	7_2_0475746D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04750050 mov eax, dword ptr fs:[00000030h]	7_2_04750050
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04750050 mov eax, dword ptr fs:[00000030h]	7_2_04750050
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CC450 mov eax, dword ptr fs:[00000030h]	7_2_047CC450
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CC450 mov eax, dword ptr fs:[00000030h]	7_2_047CC450
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A44B mov eax, dword ptr fs:[00000030h]	7_2_0476A44B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808CD6 mov eax, dword ptr fs:[00000030h]	7_2_04808CD6
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476BC2C mov eax, dword ptr fs:[00000030h]	7_2_0476BC2C
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]	7_2_0476002D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]	7_2_0476002D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]	7_2_0476002D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]	7_2_0476002D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476002D mov eax, dword ptr fs:[00000030h]	7_2_0476002D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]	7_2_0474B02A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]	7_2_0474B02A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]	7_2_0474B02A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474B02A mov eax, dword ptr fs:[00000030h]	7_2_0474B02A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7016 mov eax, dword ptr fs:[00000030h]	7_2_047B7016
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7016 mov eax, dword ptr fs:[00000030h]	7_2_047B7016
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7016 mov eax, dword ptr fs:[00000030h]	7_2_047B7016
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]	7_2_047B6C0A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]	7_2_047B6C0A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]	7_2_047B6C0A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6C0A mov eax, dword ptr fs:[00000030h]	7_2_047B6C0A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1C06 mov eax, dword ptr fs:[00000030h]	7_2_047F1C06
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F14FB mov eax, dword ptr fs:[00000030h]	7_2_047F14FB
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6CF0 mov eax, dword ptr fs:[00000030h]	7_2_047B6CF0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6CF0 mov eax, dword ptr fs:[00000030h]	7_2_047B6CF0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6CF0 mov eax, dword ptr fs:[00000030h]	7_2_047B6CF0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480740D mov eax, dword ptr fs:[00000030h]	7_2_0480740D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480740D mov eax, dword ptr fs:[00000030h]	7_2_0480740D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480740D mov eax, dword ptr fs:[00000030h]	7_2_0480740D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04804015 mov eax, dword ptr fs:[00000030h]	7_2_04804015
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04804015 mov eax, dword ptr fs:[00000030h]	7_2_04804015
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047358EC mov eax, dword ptr fs:[00000030h]	7_2_047358EC
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]	7_2_047CB8D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov ecx, dword ptr fs:[00000030h]	7_2_047CB8D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]	7_2_047CB8D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]	7_2_047CB8D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]	7_2_047CB8D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CB8D0 mov eax, dword ptr fs:[00000030h]	7_2_047CB8D0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476F0BF mov ecx, dword ptr fs:[00000030h]	7_2_0476F0BF
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476F0BF mov eax, dword ptr fs:[00000030h]	7_2_0476F0BF
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476F0BF mov eax, dword ptr fs:[00000030h]	7_2_0476F0BF
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]	7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]	7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]	7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]	7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]	7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047620A0 mov eax, dword ptr fs:[00000030h]	7_2_047620A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047790AF mov eax, dword ptr fs:[00000030h]	7_2_047790AF
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474849B mov eax, dword ptr fs:[00000030h]	7_2_0474849B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739080 mov eax, dword ptr fs:[00000030h]	7_2_04739080
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04801074 mov eax, dword ptr fs:[00000030h]	7_2_04801074
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B3884 mov eax, dword ptr fs:[00000030h]	7_2_047B3884
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B3884 mov eax, dword ptr fs:[00000030h]	7_2_047B3884
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B171 mov eax, dword ptr fs:[00000030h]	7_2_0473B171
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B171 mov eax, dword ptr fs:[00000030h]	7_2_0473B171
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475C577 mov eax, dword ptr fs:[00000030h]	7_2_0475C577
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475C577 mov eax, dword ptr fs:[00000030h]	7_2_0475C577
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C962 mov eax, dword ptr fs:[00000030h]	7_2_0473C962
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04757D50 mov eax, dword ptr fs:[00000030h]	7_2_04757D50
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048005AC mov eax, dword ptr fs:[00000030h]	7_2_048005AC
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_048005AC mov eax, dword ptr fs:[00000030h]	7_2_048005AC
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475B944 mov eax, dword ptr fs:[00000030h]	7_2_0475B944
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475B944 mov eax, dword ptr fs:[00000030h]	7_2_0475B944
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04773D43 mov eax, dword ptr fs:[00000030h]	7_2_04773D43
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B3540 mov eax, dword ptr fs:[00000030h]	7_2_047B3540
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04743D34 mov eax, dword ptr fs:[00000030h]	7_2_04743D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473AD30 mov eax, dword ptr fs:[00000030h]	7_2_0473AD30
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476513A mov eax, dword ptr fs:[00000030h]	7_2_0476513A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476513A mov eax, dword ptr fs:[00000030h]	7_2_0476513A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047BA537 mov eax, dword ptr fs:[00000030h]	7_2_047BA537
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764D3B mov eax, dword ptr fs:[00000030h]	7_2_04764D3B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764D3B mov eax, dword ptr fs:[00000030h]	7_2_04764D3B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764D3B mov eax, dword ptr fs:[00000030h]	7_2_04764D3B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]	7_2_04754120
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]	7_2_04754120
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]	7_2_04754120
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov eax, dword ptr fs:[00000030h]	7_2_04754120
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04754120 mov ecx, dword ptr fs:[00000030h]	7_2_04754120
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739100 mov eax, dword ptr fs:[00000030h]	7_2_04739100
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739100 mov eax, dword ptr fs:[00000030h]	7_2_04739100
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739100 mov eax, dword ptr fs:[00000030h]	7_2_04739100
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047E8DF1 mov eax, dword ptr fs:[00000030h]	7_2_047E8DF1
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B1E1 mov eax, dword ptr fs:[00000030h]	7_2_0473B1E1
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B1E1 mov eax, dword ptr fs:[00000030h]	7_2_0473B1E1
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473B1E1 mov eax, dword ptr fs:[00000030h]	7_2_0473B1E1
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047C41E8 mov eax, dword ptr fs:[00000030h]	7_2_047C41E8
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474D5E0 mov eax, dword ptr fs:[00000030h]	7_2_0474D5E0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474D5E0 mov eax, dword ptr fs:[00000030h]	7_2_0474D5E0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]	7_2_047FFDE2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]	7_2_047FFDE2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]	7_2_047FFDE2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FFDE2 mov eax, dword ptr fs:[00000030h]	7_2_047FFDE2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]	7_2_047B6DC9
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]	7_2_047B6DC9
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]	7_2_047B6DC9
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov ecx, dword ptr fs:[00000030h]	7_2_047B6DC9
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]	7_2_047B6DC9
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B6DC9 mov eax, dword ptr fs:[00000030h]	7_2_047B6DC9
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808D34 mov eax, dword ptr fs:[00000030h]	7_2_04808D34
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04761DB5 mov eax, dword ptr fs:[00000030h]	7_2_04761DB5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04761DB5 mov eax, dword ptr fs:[00000030h]	7_2_04761DB5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04761DB5 mov eax, dword ptr fs:[00000030h]	7_2_04761DB5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]	7_2_047B51BE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]	7_2_047B51BE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]	7_2_047B51BE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B51BE mov eax, dword ptr fs:[00000030h]	7_2_047B51BE
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047661A0 mov eax, dword ptr fs:[00000030h]	7_2_047661A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047661A0 mov eax, dword ptr fs:[00000030h]	7_2_047661A0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047635A1 mov eax, dword ptr fs:[00000030h]	7_2_047635A1
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B69A6 mov eax, dword ptr fs:[00000030h]	7_2_047B69A6
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762990 mov eax, dword ptr fs:[00000030h]	7_2_04762990
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476FD9B mov eax, dword ptr fs:[00000030h]	7_2_0476FD9B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476FD9B mov eax, dword ptr fs:[00000030h]	7_2_0476FD9B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A185 mov eax, dword ptr fs:[00000030h]	7_2_0476A185
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475C182 mov eax, dword ptr fs:[00000030h]	7_2_0475C182
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]	7_2_04762581
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]	7_2_04762581
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]	7_2_04762581
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762581 mov eax, dword ptr fs:[00000030h]	7_2_04762581
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]	7_2_04732D8A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]	7_2_04732D8A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]	7_2_04732D8A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]	7_2_04732D8A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04732D8A mov eax, dword ptr fs:[00000030h]	7_2_04732D8A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]	7_2_0475AE73
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]	7_2_0475AE73
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]	7_2_0475AE73
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]	7_2_0475AE73
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475AE73 mov eax, dword ptr fs:[00000030h]	7_2_0475AE73
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0477927A mov eax, dword ptr fs:[00000030h]	7_2_0477927A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474766D mov eax, dword ptr fs:[00000030h]	7_2_0474766D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EB260 mov eax, dword ptr fs:[00000030h]	7_2_047EB260
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EB260 mov eax, dword ptr fs:[00000030h]	7_2_047EB260
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04800EA5 mov eax, dword ptr fs:[00000030h]	7_2_04800EA5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04800EA5 mov eax, dword ptr fs:[00000030h]	7_2_04800EA5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04800EA5 mov eax, dword ptr fs:[00000030h]	7_2_04800EA5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FEA55 mov eax, dword ptr fs:[00000030h]	7_2_047FEA55
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047C4257 mov eax, dword ptr fs:[00000030h]	7_2_047C4257
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]	7_2_04739240
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]	7_2_04739240
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]	7_2_04739240
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04739240 mov eax, dword ptr fs:[00000030h]	7_2_04739240
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]	7_2_04747E41
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]	7_2_04747E41
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]	7_2_04747E41
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]	7_2_04747E41
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]	7_2_04747E41
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04747E41 mov eax, dword ptr fs:[00000030h]	7_2_04747E41
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FAE44 mov eax, dword ptr fs:[00000030h]	7_2_047FAE44
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047FAE44 mov eax, dword ptr fs:[00000030h]	7_2_047FAE44
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EFE3F mov eax, dword ptr fs:[00000030h]	7_2_047EFE3F
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473E620 mov eax, dword ptr fs:[00000030h]	7_2_0473E620
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808ED6 mov eax, dword ptr fs:[00000030h]	7_2_04808ED6
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04774A2C mov eax, dword ptr fs:[00000030h]	7_2_04774A2C
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04774A2C mov eax, dword ptr fs:[00000030h]	7_2_04774A2C
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov eax, dword ptr fs:[00000030h]	7_2_04735210
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov ecx, dword ptr fs:[00000030h]	7_2_04735210
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov eax, dword ptr fs:[00000030h]	7_2_04735210
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04735210 mov eax, dword ptr fs:[00000030h]	7_2_04735210
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473AA16 mov eax, dword ptr fs:[00000030h]	7_2_0473AA16
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473AA16 mov eax, dword ptr fs:[00000030h]	7_2_0473AA16
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04753A1C mov eax, dword ptr fs:[00000030h]	7_2_04753A1C
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A61C mov eax, dword ptr fs:[00000030h]	7_2_0476A61C
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A61C mov eax, dword ptr fs:[00000030h]	7_2_0476A61C
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C600 mov eax, dword ptr fs:[00000030h]	7_2_0473C600
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C600 mov eax, dword ptr fs:[00000030h]	7_2_0473C600
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473C600 mov eax, dword ptr fs:[00000030h]	7_2_0473C600
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04768E00 mov eax, dword ptr fs:[00000030h]	7_2_04768E00
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F1608 mov eax, dword ptr fs:[00000030h]	7_2_047F1608
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04748A0A mov eax, dword ptr fs:[00000030h]	7_2_04748A0A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762AE4 mov eax, dword ptr fs:[00000030h]	7_2_04762AE4
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047616E0 mov ecx, dword ptr fs:[00000030h]	7_2_047616E0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047476E2 mov eax, dword ptr fs:[00000030h]	7_2_047476E2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04778EC7 mov eax, dword ptr fs:[00000030h]	7_2_04778EC7
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047636CC mov eax, dword ptr fs:[00000030h]	7_2_047636CC
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762ACB mov eax, dword ptr fs:[00000030h]	7_2_04762ACB
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047EFEC0 mov eax, dword ptr fs:[00000030h]	7_2_047EFEC0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474AAB0 mov eax, dword ptr fs:[00000030h]	7_2_0474AAB0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474AAB0 mov eax, dword ptr fs:[00000030h]	7_2_0474AAB0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476FAB0 mov eax, dword ptr fs:[00000030h]	7_2_0476FAB0
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]	7_2_047352A5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]	7_2_047352A5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]	7_2_047352A5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]	7_2_047352A5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047352A5 mov eax, dword ptr fs:[00000030h]	7_2_047352A5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B46A7 mov eax, dword ptr fs:[00000030h]	7_2_047B46A7
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476D294 mov eax, dword ptr fs:[00000030h]	7_2_0476D294
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476D294 mov eax, dword ptr fs:[00000030h]	7_2_0476D294
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808A62 mov eax, dword ptr fs:[00000030h]	7_2_04808A62
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CFE87 mov eax, dword ptr fs:[00000030h]	7_2_047CFE87
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04763B7A mov eax, dword ptr fs:[00000030h]	7_2_04763B7A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04763B7A mov eax, dword ptr fs:[00000030h]	7_2_04763B7A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473DB60 mov ecx, dword ptr fs:[00000030h]	7_2_0473DB60
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474FF60 mov eax, dword ptr fs:[00000030h]	7_2_0474FF60
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04805BA5 mov eax, dword ptr fs:[00000030h]	7_2_04805BA5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473F358 mov eax, dword ptr fs:[00000030h]	7_2_0473F358
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0473DB40 mov eax, dword ptr fs:[00000030h]	7_2_0473DB40
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0474EF40 mov eax, dword ptr fs:[00000030h]	7_2_0474EF40
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476E730 mov eax, dword ptr fs:[00000030h]	7_2_0476E730
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04734F2E mov eax, dword ptr fs:[00000030h]	7_2_04734F2E
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04734F2E mov eax, dword ptr fs:[00000030h]	7_2_04734F2E
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475F716 mov eax, dword ptr fs:[00000030h]	7_2_0475F716
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F131B mov eax, dword ptr fs:[00000030h]	7_2_047F131B
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CFF10 mov eax, dword ptr fs:[00000030h]	7_2_047CFF10
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047CFF10 mov eax, dword ptr fs:[00000030h]	7_2_047CFF10
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A70E mov eax, dword ptr fs:[00000030h]	7_2_0476A70E
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476A70E mov eax, dword ptr fs:[00000030h]	7_2_0476A70E
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047737F5 mov eax, dword ptr fs:[00000030h]	7_2_047737F5
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480070D mov eax, dword ptr fs:[00000030h]	7_2_0480070D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0480070D mov eax, dword ptr fs:[00000030h]	7_2_0480070D
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]	7_2_047603E2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]	7_2_047603E2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]	7_2_047603E2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]	7_2_047603E2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]	7_2_047603E2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047603E2 mov eax, dword ptr fs:[00000030h]	7_2_047603E2
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0475DBE9 mov eax, dword ptr fs:[00000030h]	7_2_0475DBE9
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B53CA mov eax, dword ptr fs:[00000030h]	7_2_047B53CA
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B53CA mov eax, dword ptr fs:[00000030h]	7_2_047B53CA
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808B58 mov eax, dword ptr fs:[00000030h]	7_2_04808B58
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764BAD mov eax, dword ptr fs:[00000030h]	7_2_04764BAD
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764BAD mov eax, dword ptr fs:[00000030h]	7_2_04764BAD
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04764BAD mov eax, dword ptr fs:[00000030h]	7_2_04764BAD
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04748794 mov eax, dword ptr fs:[00000030h]	7_2_04748794
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04762397 mov eax, dword ptr fs:[00000030h]	7_2_04762397
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_0476B390 mov eax, dword ptr fs:[00000030h]	7_2_0476B390
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04808F6A mov eax, dword ptr fs:[00000030h]	7_2_04808F6A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7794 mov eax, dword ptr fs:[00000030h]	7_2_047B7794
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7794 mov eax, dword ptr fs:[00000030h]	7_2_047B7794
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047B7794 mov eax, dword ptr fs:[00000030h]	7_2_047B7794
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047F138A mov eax, dword ptr fs:[00000030h]	7_2_047F138A
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04741B8F mov eax, dword ptr fs:[00000030h]	7_2_04741B8F
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_04741B8F mov eax, dword ptr fs:[00000030h]	7_2_04741B8F
Source: C:\Windows\SysWOW64\logagent.exe	Code function: 7_2_047ED380 mov ecx, dword ptr fs:[00000030h]	7_2_047ED380

Source: C:\Windows\SysWOW64\logagent.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\logagent.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\logagent.exe

Code function: 7_2_04779860 NtQuerySystemInformation,LdrInitializeThunk,

7_2_04779860

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 1D0000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 1E0000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 410000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 420000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 430000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 440000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 450000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 460000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 725B0000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 470000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory written: C:\Windows\SysWOW64\logagent.exe base: 6B0000	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 725B0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 1D0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 1E0000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 410000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 420000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 430000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 440000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 450000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 460000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 470000 protect: page execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Memory allocated: C:\Windows\SysWOW64\logagent.exe base: 6B0000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Memory written: C:\Windows\SysWOW64\logagent.exe base: 725B0000 value starts with: 4D5A

Jump to behavior

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 1D0000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 420000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 460000	Jump to behavior
Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe	Thread created: C:\Windows\SysWOW64\logagent.exe EIP: 6B0000	Jump to behavior

Source: C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe

Process created: C:\Windows\SysWOW64\logagent.exe C:\Windows\System32\logagent.exe

Jump to behavior

Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: logagent.exe, 00000007.00000000.357556724.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.346735402.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.349786949.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.358833612.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.353821559.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.356544338.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360094924.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.348754041.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.347969273.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352141401.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.355535580.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.369480515.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.372477132.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.360963079.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.351047702.0000000003300000.00000002.00020000.sdmp, logagent.exe, 00000007.00000000.352912159.0000000003300000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: Amcache.hve.11.dr, Amcache.hve.LOG1.11.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.11.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.11.dr, Amcache.hve.LOG1.11.dr	Binary or memory string: procexp.exe

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.725b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.725b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.logagent.exe.6c0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.logagent.exe.6c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	DLL Side-Loading1	Process Injection412	Masquerading1	OS Credential Dumping	Security Software Discovery131	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	DLL Side-Loading1	Virtualization/Sandbox Evasion1	LSASS Memory	Virtualization/Sandbox Evasion1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection412	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	System Information Discovery11	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
FedEx TRACKING DETAILS.exe	36%	Virustotal		Browse
FedEx TRACKING DETAILS.exe	52%	ReversingLabs	Win32.Backdoor.Androm
FedEx TRACKING DETAILS.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.3.FedEx TRACKING DETAILS.exe.26e1534.338.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c9508.291.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d1914.140.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d0fb8.93.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c975c.64.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c95f8.303.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d1104.107.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f189c.44.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d25fc.8.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd434.350.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de008.143.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c53cc.145.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dd954.118.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cce64.330.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d4014.184.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c7cb8.211.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d858c.229.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c5d74.167.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cb8c4.81.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e1c44.353.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e1348.39.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c62e4.178.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c45dc.85.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c88e4.227.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.0.logagent.exe.725b0000.11.unpack	100%	Avira	TR/Crypt.Morphine.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de3c4.151.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c6f60.197.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c88e0.231.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d6ecc.218.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b88.236.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d1104.108.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8dfc.35.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b84.239.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d421c.193.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e9e68.119.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c4008.14.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dd3f0.111.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cb8c4.79.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d2eac.171.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c7d7c.216.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d4014.182.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e2180.55.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d0fb8.90.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8ecc.251.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f4008.71.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ea4f8.290.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c4e74.106.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c5504.154.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b84.241.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26eaa28.308.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d91b4.253.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
7.0.logagent.exe.6c0000.8.unpack	100%	Avira	TR/Crypt.ZPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e4008.202.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e0fb8.321.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e42c4.27.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ca2bc.309.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9ca8.51.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9494.258.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d25fc.10.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e130c.333.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9ca8.54.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c8b88.235.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e1c2c.351.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd43c.356.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e90a8.247.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c0fd0.47.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f0008.196.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e42c4.30.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d2c04.162.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cc0b4.22.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d9774.263.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26db95c.311.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c527c.138.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c4e70.99.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c11a0.61.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de3c4.148.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de758.159.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ca1c8.15.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c93bc.50.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd3f4.7.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dbffc.242.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d3840.84.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d8ad4.238.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e4008.200.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dffc8.172.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e9518.104.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26f0008.194.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c9434.285.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26de758.156.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26c2104.74.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dddf4.126.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26d39ac.179.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dffc8.170.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cd3f4.5.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ef590.186.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ec37c.31.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26e10e4.331.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26cb5dc.77.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26dbffc.240.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
1.3.FedEx TRACKING DETAILS.exe.26ea68c.58.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
www.hdetpnipa.xyz/a34b/	10%	Virustotal		Browse
www.hdetpnipa.xyz/a34b/	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
onedrive.live.com	unknown	unknown	false		high
3eie8a.sn.files.1drv.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
www.hdetpnipa.xyz/a34b/	true	10%, Virustotal, Browse Avira URL Cloud: phishing	low

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://3eie8a.sn.files.1drv.com/y4mTGtN2XEyFxr4Fwg2GfGDYA-weizJsEgCfvnFlKm_xwhWQiYk4SVd3YN1FLBVj9kD	FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp	false	high
https://onedrive.live.com/B&resid=C34B41C1B35825CB%21140&authkey=AN9sEgEIgUt16GA	FedEx TRACKING DETAILS.exe, 00000001.00000003.312794774.0000000000832000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	false	high
http://upx.sf.net	Amcache.hve.11.dr	false	high
http://schemas.xmlsoap.org/ws/2004/09/policy	WerFault.exe, 0000000B.00000002.393477883.0000000005410000.00000004.00000001.sdmp	false	high
https://onedrive.live.com/download?cid=C34B41C1B35825CB&resid=C34B41C1B35825CB%21140&authkey=AN9sEgE	FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	false	high
https://3eie8a.sn.files.1drv.com/y4mwmaWo75uzUwtwpwSnt0PfQZClqYm-BqTi81xEEYBIo3hzrTU99nIAl5l4jRjpvu3	FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	false	high
https://3eie8a.sn.files.1drv.com/	FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310664901.0000000000832000.00000004.00000001.sdmp	false	high
https://3eie8a.sn.files.1drv.com/C	FedEx TRACKING DETAILS.exe, 00000001.00000003.312773374.00000000007F8000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.309668822.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.311676556.00000000007FF000.00000004.00000001.sdmp, FedEx TRACKING DETAILS.exe, 00000001.00000003.310643764.00000000007FF000.00000004.00000001.sdmp	false	high
https://onedrive.live.com/	FedEx TRACKING DETAILS.exe, 00000001.00000003.311710977.0000000000832000.00000004.00000001.sdmp	false	high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532861
Start date:	02.12.2021
Start time:	19:01:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	FedEx TRACKING DETAILS.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@4/7@2/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 100% (good quality ratio 86.3%) Quality average: 71.1% Quality standard deviation: 33.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 4 Number of non-executed functions: 174
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 13.107.42.13, 13.107.42.12, 52.168.117.173 Excluded domains from analysis (whitelisted): odc-web-brs.onedrive.akadns.net, onedsblobprdeus16.eastus.cloudapp.azure.com, sn-files.ha.1drv.com.l-0003.dc-msedge.net.l-0003.l-msedge.net, odc-web-geo.onedrive.akadns.net, odc-sn-files-geo.onedrive.akadns.net, ctldl.windowsupdate.com, arc.msn.com, ris.api.iris.microsoft.com, l-0004.l-msedge.net, odwebpl.trafficmanager.net.l-0004.dc-msedge.net.l-0004.l-msedge.net, odc-sn-files-brs.onedrive.akadns.net, l-0003.l-msedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:02:16	API Interceptor	1x Sleep call for process: FedEx TRACKING DETAILS.exe modified
19:02:55	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_logagent.exe_131232484c36b2f738ed9f8bca70746a5db0df_0357e9de_121e11bd\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7680010292392891
Encrypted:	false
SSDEEP:	96:CzpFyTUlstcneIb6oI7JfapXIQcQvc6QcEDMcw3DSDq+HbHgoC5AJkq+h88WpB8B:E5itcnDHBUZMXojFq/u7smS274ItQT
MD5:	419C342E2FF1D66525019CF8A7412F8A
SHA1:	2160A039CE1626B5C19985EDC43001DB18E3FA16
SHA-256:	CC9EF71255F0687FE00477DF292D7AD7A1EAE6DC7AB73CA1EA3BB0C8A5D47F52
SHA-512:	15D0C391C989975E35D065A76EFBD137EA2E1BF9CD7D73D5A5EF3D8E9B1B6CD4366993ACC51D55733544F0E4D35E84C6C40542E86AFD411B83BFEC8C6DD088B2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.9.7.4.1.6.9.8.1.9.9.7.4.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.9.7.4.1.7.3.8.8.2.4.5.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.c.e.1.2.7.f.d.4.-.7.f.d.a.-.4.d.3.8.-.9.1.f.9.-.9.4.c.2.9.5.0.c.b.3.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.b.e.e.5.a.1.6.-.f.b.0.4.-.4.e.a.9.-.9.2.d.a.-.e.0.8.2.3.a.8.6.f.8.a.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.g.a.g.e.n.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.l.o.g.a.g.e.n.t...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.4.8.-.0.0.0.1.-.0.0.1.c.-.c.e.f.5.-.3.2.3.7.f.2.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.5.8.d.c.4.a.2.6.c.e.8.7.e.b.d.d.a.8.2.4.7.e.4.2.b.1.5.6.c.a.9.b.4.c.0.b.a.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER124.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8310
Entropy (8bit):	3.695731414622114
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiOG6mqUm6YLM6+PgmfcLSaCprh89b2hsfo0Sm:RrlsNiX6NUm6YQ6Ggmf4Ss2afN
MD5:	063F7D56170385E625802CC652610447
SHA1:	0DC00C5627088CEB143EA2B7CFC1E9360E03353C
SHA-256:	3F12E53652B361A6A37801A732FEAFA0B4AE1BEE74BDA54AF1A2DC0327E9DDCD
SHA-512:	CE1BD71C0AED946C6CC27BF237053D6ADC383612DBC7C0D3C0370195DEB4F4929DB11A62AF904797D1FD5BACF5690BE30C15A7AAA706531AC9267AD07AA1D368
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.4.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AF.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	4.476819952907959
Encrypted:	false
SSDEEP:	48:cvIwSD8zsvJgtWI90aWSC8BS8fm8M4JemfZFmj+q86Gvx7Fcfrmrd:uITfRfbSNBJnyjox7Furmrd
MD5:	336F69F3EC0897593738A0A982C59B9A
SHA1:	76CED5ACBC0EC8D632735F57BCBB5B176717A888
SHA-256:	2DDA1DF2C6660E634F389EBC8F503484B9AF03A59D1009B4C52F2908DC75222B
SHA-512:	7D83AB3B3BAA5E6A9E77A3EFF41138907BFB850A078E09539625E2251E06E583C098693DA3205004010939A913CA0EF80974351802546FFC7068CDEF066570A7
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1280893" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC41.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 3 03:02:50 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	47606
Entropy (8bit):	1.7988139734386561
Encrypted:	false
SSDEEP:	192:5GuBz473Be7zOWQ2ybM/ifHXsmao+2cf9YUni:E73B8qWQUivXsgcW
MD5:	5B0A9E1019955F0C1E419FAB47D191AE
SHA1:	B9C8571135C1A6A59BFC86323B6608C00F2F34AB
SHA-256:	45461A2551690183BD56F18FE4A1D8F2A3716D2B5CDBD49097EDD5AC9070A2EF
SHA-512:	8157CC2E4302FEB4729EDFB46DB854FAE2003CF80EC22FB469DD0866119811256A2B55D4BBB0598521792F464C443C263CA875D104DE1979C4E7A225309B2731
Malicious:	false
Reputation:	low
Preview:	MDMP....... .........a........................$...........$...*%..........T.......8...........T...............^............................................................................................U...........B......t.......GenuineIntelW...........T.......H.....a.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Ipknvfrclgulizdtylbxizfhvowtamb[1] Download File
Process:	C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe
File Type:	data
Category:	dropped
Size (bytes):	304640
Entropy (8bit):	7.998000849555144
Encrypted:	true
SSDEEP:	6144:K728FG5e8FW+j7HoyEHTmcCknu7yB2A7X37dcVhPsBZ6Q/cnb1kTpm+BxOn:/1e8FW+j7Irqxkn+9AL37dokBZ6Tnb1p
MD5:	C4357B267D515956EA1CB9AED8413834
SHA1:	7DD659D3772D23142E9040D32057095A37123437
SHA-256:	D75F7B2470A35DFCE5AD17422908FD0C085776F3D252C4CAA855DFABF1136984
SHA-512:	51F9D250C71573E6C5CFCE0ADA38F04FE358FC64FB8EF417481BD90CC5D768F30DE418B08E4BDB5FEE955E80A21920B168643626FA30A86EA53B0A1CCCC74479
Malicious:	false
Reputation:	low
Preview:	...,y...Z.\..S....)....x..q...x..q..>...%....v.Z.....3....C..D...;...K..#..Z.L)...1.2kv.....5...+.p.F.9.WF.....!...x..q...x..q..>...%....v.Z.....3....C..D...;...K..#..Z.L)...1.2kv.....5...+.p.F.9.WF.....!...x..q...x..q..>...%....v.Z.....3....C.l.cK......Z......#......NBe_I./...Q....Y^.{:...6..=....t.....!.Dp...%.J."Y^.{:...6..=....t.....!.Dp...%.J..L>x.%..-..p.}L9..`.@aV.US.iWgz.&J..L>x.%..-..p.}L9..`.@aV.US.iWgz.&J..L>x.%..-..p.}L9..`.@aV.US.iWgz.&J+R.Y.\|..E3Zu.4.UjTx/V}.U...e.\|.E,..>.&.lTx-D.]...5N...C4..nXw..3M.Z.....>./....X6.....drm..~Y.;....u.\)"...-b.W...~\....k.i........i..E<...>..]...[..$.a.s...~...i..E<...>..]...[..$.a.s...~...i..E<...>..]...[..$.a.s...~...i..E<...>..]...[..$.a.s...Y....L...b".~....I.fK..8.....To....0s.]..........5G....}.........x.'m.}...nY....+c..J...Q..nY.y./V...m..w..u....._..{..>......l@..1Xi.S..\p<..e.(......&.....5A?3G.[.../U..)c.-Zo.5W... ..#v'v5Vx&.v/Q..Zv(..4.\u..i.....6.*.E9?3K.....P..\|..6......

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.277492162857272
Encrypted:	false
SSDEEP:	12288:15pAHpPpGqxnemhizybkiFOEZlxJw5qJfJa4gDXNTqYMd5LC4UzfYQ:vpAHpPpGqxnemhWT
MD5:	F5278E8C90C6CD7F46EEAEC5CA6492EF
SHA1:	1B088B8E770B36A14C898689C615B4FBDE3303F2
SHA-256:	0E6C371B3907EAD27B65988EC532B2B3C5D3F65CD2D76608BCA039C1F884215D
SHA-512:	09687E0F4152D0ED322F6D4A40B6155C077FCA5369A95F3EE112B46DA9E12D4FC7D7023647CAC1C4F3E1C8AE85FBA7D8CA3FF283CFB75F59DC8DE3D749CC3233
Malicious:	false
Reputation:	low
Preview:	regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm>..@.................................................................................................................................................................................................................................................................................................................................................G..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	4.02994997432179
Encrypted:	false
SSDEEP:	384:I9cs5Rftx1OPJ4X9seFnh7khPBqXeSeq5QMVyi6+/rl4Lk4TZd1DoXznqGUXvu:McaRftx10J4XaeFh7KBqXleq5QMVyi6L
MD5:	C5C36F93BAF245509167136DFF19024F
SHA1:	7EECA1040B8962D0DB6EB612A9AD9141DE8E9F5E
SHA-256:	BC1B85E63C38939BA308CF8C1BC6B7363434358957AC3DAA969A3438AA216C95
SHA-512:	0CED1208041C041C193F517701CF3FDBB554D352504DB2D5A455B3EF270BEA4DA4F1F5D392B311BE3C8349681A9AE779F073E9F9A61245F7BCDD93BE5DB6C108
Malicious:	false
Reputation:	low
Preview:	regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm>..@.................................................................................................................................................................................................................................................................................................................................................G..HvLE.^......Y....................{...S>.........0................... ..hbin................p.\..,..........nk,..u.@........ ........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..u.@........ ........................... .......Z.......................Root........lf......Root....nk ..u.@.....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.715076012164725
TrID:	Win32 Executable (generic) a (10002005/4) 90.87% Win32 Executable Borland Delphi 7 (665061/41) 6.04% Win32 Executable Borland Delphi 6 (262906/60) 2.39% InstallShield setup (43055/19) 0.39% Win32 Executable Delphi generic (14689/80) 0.13%
File name:	FedEx TRACKING DETAILS.exe
File size:	697856
MD5:	32414d4cae15c3a8063bf1251346533c
SHA1:	3e92cca40b5b3bde11265ea773e77e0cd2432f96
SHA256:	d6b4f7ba99b492e9b2382b51f6c49b32e86cc81b7fc6c93313f5962de4b910bd
SHA512:	a1af25aab065a83f5cac7a8ae89e9cae22a4014f2440f954773be0855950bb110aa28187da898b07dc795900d7181b1461541b29767fd45ab0336b3689ac6769
SSDEEP:	12288:CIEpAb3iVUYfqUe+L7JMlbv7fkgx8BcFcePyaW:CI8G3DYfq9+hMNTMK8Cbm
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	3670910284e2d9b0

Static PE Info

General
Entrypoint:	0x45ac10
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	bbc9c0e1dd018627fbe5726a5fc2ba6c

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0045A9B8h
call 00007F1524E818C9h
nop
nop
nop
nop
nop
nop
mov eax, dword ptr [0045C2ECh]
mov eax, dword ptr [eax]
call 00007F1524ECD08Bh
mov ecx, dword ptr [0045C468h]
mov eax, dword ptr [0045C2ECh]
mov eax, dword ptr [eax]
mov edx, dword ptr [0045A768h]
call 00007F1524ECD08Bh
mov eax, dword ptr [0045C2ECh]
mov eax, dword ptr [eax]
call 00007F1524ECD0FFh
call 00007F1524E7F536h
nop
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5e000	0x210a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x6a000	0x46600	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x63000	0x636c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x62000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x59c5c	0x59e00	False	0.533007540855	data	6.54076370728	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
DATA	0x5b000	0x1480	0x1600	False	0.412642045455	data	3.98462224633	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
BSS	0x5d000	0xda5	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x5e000	0x210a	0x2200	False	0.361443014706	data	4.94811291969	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x61000	0x10	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x62000	0x18	0x200	False	0.05078125	data	0.199107517787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x63000	0x636c	0x6400	False	0.6420703125	data	6.6906267798	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x6a000	0x46600	0x46600	False	0.417646120115	data	5.79742330784	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x6b23c	0x134	data
RT_CURSOR	0x6b370	0x134	data
RT_CURSOR	0x6b4a4	0x134	data
RT_CURSOR	0x6b5d8	0x134	data
RT_CURSOR	0x6b70c	0x134	data
RT_CURSOR	0x6b840	0x134	data
RT_CURSOR	0x6b974	0x134	data
RT_BITMAP	0x6baa8	0x1d0	data
RT_BITMAP	0x6bc78	0x1e4	data
RT_BITMAP	0x6be5c	0x1d0	data
RT_BITMAP	0x6c02c	0x1d0	data
RT_BITMAP	0x6c1fc	0x1d0	data
RT_BITMAP	0x6c3cc	0x1d0	data
RT_BITMAP	0x6c59c	0x1d0	data
RT_BITMAP	0x6c76c	0x1d0	data
RT_BITMAP	0x6c93c	0x1d0	data
RT_BITMAP	0x6cb0c	0x1d0	data
RT_BITMAP	0x6ccdc	0x128	data
RT_BITMAP	0x6ce04	0x128	data
RT_BITMAP	0x6cf2c	0x128	data
RT_BITMAP	0x6d054	0xe8	data
RT_BITMAP	0x6d13c	0x128	data
RT_BITMAP	0x6d264	0x128	data
RT_BITMAP	0x6d38c	0xd0	data
RT_BITMAP	0x6d45c	0x128	data
RT_BITMAP	0x6d584	0x128	data
RT_BITMAP	0x6d6ac	0x128	data
RT_BITMAP	0x6d7d4	0x128	data
RT_BITMAP	0x6d8fc	0x128	data
RT_BITMAP	0x6da24	0xe8	data
RT_BITMAP	0x6db0c	0x128	data
RT_BITMAP	0x6dc34	0x128	data
RT_BITMAP	0x6dd5c	0xd0	data
RT_BITMAP	0x6de2c	0x128	data
RT_BITMAP	0x6df54	0x128	data
RT_BITMAP	0x6e07c	0x128	data
RT_BITMAP	0x6e1a4	0x128	data
RT_BITMAP	0x6e2cc	0x128	data
RT_BITMAP	0x6e3f4	0xe8	data
RT_BITMAP	0x6e4dc	0x128	data
RT_BITMAP	0x6e604	0x128	data
RT_BITMAP	0x6e72c	0xd0	data
RT_BITMAP	0x6e7fc	0x128	data
RT_BITMAP	0x6e924	0x128	data
RT_BITMAP	0x6ea4c	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x6eb34	0x10a8	data	English	United States
RT_ICON	0x6fbdc	0x25a8	data	English	United States
RT_DIALOG	0x72184	0x52	data
RT_STRING	0x721d8	0x244	data
RT_STRING	0x7241c	0x1f0	data
RT_STRING	0x7260c	0x1c0	data
RT_STRING	0x727cc	0xdc	data
RT_STRING	0x728a8	0x2f4	data
RT_STRING	0x72b9c	0xdc	data
RT_STRING	0x72c78	0x10c	data
RT_STRING	0x72d84	0x33c	data
RT_STRING	0x730c0	0x3d4	data
RT_STRING	0x73494	0x3a4	data
RT_STRING	0x73838	0x3e8	data
RT_STRING	0x73c20	0xf4	data
RT_STRING	0x73d14	0xc4	data
RT_STRING	0x73dd8	0x2c0	data
RT_STRING	0x74098	0x478	data
RT_STRING	0x74510	0x3ac	data
RT_STRING	0x748bc	0x2d4	data
RT_RCDATA	0x74b90	0x10	data
RT_RCDATA	0x74ba0	0x310	data
RT_RCDATA	0x74eb0	0x3b5a8	GIF image data, version 89a, 744 x 119	English	United States
RT_GROUP_CURSOR	0xb0458	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb046c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb0480	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb0494	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb04a8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb04bc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb04d0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0xb04e4	0x22	data	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
advapi32	AuditFree
uRL	InetIsOffline

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2021 19:02:17.356704950 CET	52130	53	192.168.2.3	8.8.8.8
Dec 2, 2021 19:02:18.154975891 CET	55102	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Dec 2, 2021 19:02:17.356704950 CET	192.168.2.3	8.8.8.8	0x7a68	Standard query (0)	onedrive.live.com	A (IP address)	IN (0x0001)
Dec 2, 2021 19:02:18.154975891 CET	192.168.2.3	8.8.8.8	0x6502	Standard query (0)	3eie8a.sn.files.1drv.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Type	Class
Dec 2, 2021 19:02:17.374954939 CET	8.8.8.8	192.168.2.3	0x7a68	No error (0)	onedrive.live.com	odc-web-geo.onedrive.akadns.net	CNAME (Canonical name)	IN (0x0001)
Dec 2, 2021 19:02:18.199157953 CET	8.8.8.8	192.168.2.3	0x6502	No error (0)	3eie8a.sn.files.1drv.com	sn-files.fe.1drv.com	CNAME (Canonical name)	IN (0x0001)
Dec 2, 2021 19:02:18.199157953 CET	8.8.8.8	192.168.2.3	0x6502	No error (0)	sn-files.fe.1drv.com	odc-sn-files-geo.onedrive.akadns.net	CNAME (Canonical name)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: FedEx TRACKING DETAILS.exe PID: 6348 Parent PID: 5308

General

Start time:	19:02:08
Start date:	02/12/2021
Path:	C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\FedEx TRACKING DETAILS.exe"
Imagebase:	0x400000
File size:	697856 bytes
MD5 hash:	32414D4CAE15C3A8063BF1251346533C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Chronological Activities

Analysis Process: logagent.exe PID: 3144 Parent PID: 6348

General

Start time:	19:02:32
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\logagent.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\logagent.exe
Imagebase:	0x12e0000
File size:	86016 bytes
MD5 hash:	E2036AC444AB4AD91EECC1A80FF7212F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.369906603.00000000725B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.368986547.00000000006C0000.00000040.00000010.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.370945934.00000000006C0000.00000040.00000010.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.400149920.00000000725B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000002.394673690.00000000006C0000.00000040.00000010.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000007.00000000.372945434.00000000725B0000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	moderate

Chronological Activities

Analysis Process: WerFault.exe PID: 4848 Parent PID: 3144

General

Start time:	19:02:47
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3144 -s 368
Imagebase:	0x1250000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: logagent.exe PID: 3144 Parent PID: 6348 logagent.exeCOMMON

Executed Functions

Function 04779860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0477986A

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 92d6776fad4ad525ae32368690aa2c556c6033913f99fb2ef3712c8b39c77a81
Instruction ID: 356edf8a4880885a38f981b1f7cb51325498aa8af4b22352ec53afeccdb78dc1
Opcode Fuzzy Hash: 92d6776fad4ad525ae32368690aa2c556c6033913f99fb2ef3712c8b39c77a81
Instruction Fuzzy Hash: 6590027124100417F12171598504B07000997E4285F91C426E041556CD9696D956B161

Uniqueness

Uniqueness Score: -1.00%

Function 04779660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0477966A

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 49e9a3b5a0dc50e78b9504f195f9b46123f8f0926a5eed710a922e983a5ccbbb
Instruction ID: 5584065e4659a6f654b6ed98886a48f8ed3146c547bc0abd48e41dbbb9215a97
Opcode Fuzzy Hash: 49e9a3b5a0dc50e78b9504f195f9b46123f8f0926a5eed710a922e983a5ccbbb
Instruction Fuzzy Hash: 5590027124100806F19071598404A4A000597E5345F91C029E0016668DCA55DA5D77E1

Uniqueness

Uniqueness Score: -1.00%

Function 047796E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 047796EA

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: db0735b18d546544b6607461e4394b7b13f0f9c8f33025e7c289e36645050491
Instruction ID: edab0d42843aaa35cee782205310f3b0cd00cd190351771c6fb6a8024e779e0f
Opcode Fuzzy Hash: db0735b18d546544b6607461e4394b7b13f0f9c8f33025e7c289e36645050491
Instruction Fuzzy Hash: A990027124108806F1207159C404B4A000597E4345F55C425E441566CD86D5D8957161

Uniqueness

Uniqueness Score: -1.00%

Function 0477967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04779694

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6979fcd7bf26ebe3f22053ed97c200beb11eb11225e43d2831bae59df206c66e
Instruction ID: f348a3b8e337c0aa3fd3521df3a537db9dca7cba57e5b53e0b4bb39d6b362390
Opcode Fuzzy Hash: 6979fcd7bf26ebe3f22053ed97c200beb11eb11225e43d2831bae59df206c66e
Instruction Fuzzy Hash: D0B09BF19424C5C9FB11E7604608F17790077E4745F56C175D2024655A4778D095F5B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 047EB260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

*** Inpage error in %ws:%s, xrefs: 047EB418
<unknown>, xrefs: 047EB27E, 047EB2D1, 047EB350, 047EB399, 047EB417, 047EB48E
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 047EB38F
write to, xrefs: 047EB4A6
The instruction at %p referenced memory at %p., xrefs: 047EB432
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 047EB53F
*** A stack buffer overrun occurred in %ws:%s, xrefs: 047EB2F3
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 047EB476
*** An Access Violation occurred in %ws:%s, xrefs: 047EB48F
The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 047EB323
Go determine why that thread has not released the critical section., xrefs: 047EB3C5
*** enter .cxr %p for the context, xrefs: 047EB50D
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 047EB305
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 047EB47D
This failed because of error %Ix., xrefs: 047EB446
The instruction at %p tried to %s , xrefs: 047EB4B6
read from, xrefs: 047EB4AD, 047EB4B2
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 047EB39B
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 047EB2DC
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 047EB3D6
*** Resource timeout (%p) in %ws:%s, xrefs: 047EB352
*** then kb to get the faulting stack, xrefs: 047EB51C
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 047EB484
a NULL pointer, xrefs: 047EB4E0
The critical section is owned by thread %p., xrefs: 047EB3B9
The resource is owned shared by %d threads, xrefs: 047EB37E
an invalid address, %p, xrefs: 047EB4CF
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 047EB314
The resource is owned exclusively by thread %p, xrefs: 047EB374
*** enter .exr %p for the exception record, xrefs: 047EB4F1

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 384d1766aaad079427bccd0b16a45bd9bd84cbf18fe185719aa2e32d58abdfca
Instruction ID: 1af31d000f6fe11b7f0694a7bcfbb7d860bb656f66e0be64704723043628b746
Opcode Fuzzy Hash: 384d1766aaad079427bccd0b16a45bd9bd84cbf18fe185719aa2e32d58abdfca
Instruction Fuzzy Hash: 9581F675A40220FFEB31AA46CD4DD7B3F2AEF4AB55F40414CF5046B312E262B491DAB6

Uniqueness

Uniqueness Score: -1.00%

Function 047F1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E047F1C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0x47148a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0473B150();
				} else {
					E0473B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0x482589c);
				E0473B150("Heap error detected at %p (heap handle %p)\n",  *0x48258a0);
				_t27 =  *0x4825898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M047F1E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0473B150();
				} else {
					E0473B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E0473B150("Error code: %d - %s\n",  *0x4825898);
				_t113 =  *0x48258a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0473B150();
					} else {
						E0473B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0473B150("Parameter1: %p\n",  *0x48258a4);
				}
				_t115 =  *0x48258a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0473B150();
					} else {
						E0473B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0473B150("Parameter2: %p\n",  *0x48258a8);
				}
				_t117 =  *0x48258ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0473B150();
					} else {
						E0473B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E0473B150("Parameter3: %p\n",  *0x48258ac);
				}
				_t119 =  *0x48258b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E0473B150();
					} else {
						E0473B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0x48258b4);
					E0473B150("Last known valid blocks: before - %p, after - %p\n",  *0x48258b0);
				} else {
					_t120 =  *0x48258b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E0473B150();
				} else {
					E0473B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E0473B150("Stack trace available at %p\n", 0x48258c0);
			}

0x047f1c10
0x047f1c16
0x047f1c1e
0x047f1c3d
0x047f1c3e
0x047f1c20
0x047f1c35
0x047f1c3a
0x047f1c44
0x047f1c55
0x047f1c5a
0x047f1c65
0x047f1c67
0x00000000
0x047f1c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x047f1c67
0x047f1cdc
0x047f1ce5
0x047f1d04
0x047f1d05
0x047f1ce7
0x047f1cfc
0x047f1d01
0x047f1d0b
0x047f1d17
0x047f1d1f
0x047f1d25
0x047f1d30
0x047f1d4f
0x047f1d50
0x047f1d32
0x047f1d47
0x047f1d4c
0x047f1d61
0x047f1d67
0x047f1d68
0x047f1d6e
0x047f1d79
0x047f1d98
0x047f1d99
0x047f1d7b
0x047f1d90
0x047f1d95
0x047f1daa
0x047f1db0
0x047f1db1
0x047f1db7
0x047f1dc2
0x047f1de1
0x047f1de2
0x047f1dc4
0x047f1dd9
0x047f1dde
0x047f1df3
0x047f1df9
0x047f1dfa
0x047f1e00
0x047f1e0a
0x047f1e13
0x047f1e32
0x047f1e33
0x047f1e15
0x047f1e2a
0x047f1e2f
0x047f1e39
0x047f1e4a
0x047f1e02
0x047f1e02
0x047f1e08
0x00000000
0x00000000
0x047f1e08
0x047f1e5b
0x047f1e7a
0x047f1e7b
0x047f1e5d
0x047f1e72
0x047f1e77
0x047f1e95

Strings

Stack trace available at %p, xrefs: 047F1E86
heap_failure_unknown, xrefs: 047F1C75
HEAP: , xrefs: 047F1C16, 047F1C3D, 047F1D04, 047F1D4F, 047F1D98, 047F1DE1, 047F1E32, 047F1E7A
Heap error detected at %p (heap handle %p), xrefs: 047F1C50
heap_failure_virtual_block_corruption, xrefs: 047F1C91
Error code: %d - %s, xrefs: 047F1D12
heap_failure_internal, xrefs: 047F1C6E
heap_failure_buffer_underrun, xrefs: 047F1C9F
heap_failure_freelists_corruption, xrefs: 047F1CC9
Parameter1: %p, xrefs: 047F1D5C
heap_failure_buffer_overrun, xrefs: 047F1C98
heap_failure_multiple_entries_corruption, xrefs: 047F1C8A
heap_failure_block_not_busy, xrefs: 047F1CA6
heap_failure_usage_after_free, xrefs: 047F1CBB
Last known valid blocks: before - %p, after - %p, xrefs: 047F1E45
HEAP[%wZ]: , xrefs: 047F1C30, 047F1CF7, 047F1D42, 047F1D8B, 047F1DD4, 047F1E25, 047F1E6D
Parameter2: %p, xrefs: 047F1DA5
heap_failure_generic, xrefs: 047F1C7C
heap_failure_invalid_allocation_type, xrefs: 047F1CB4
heap_failure_cross_heap_operation, xrefs: 047F1CC2
heap_failure_listentry_corruption, xrefs: 047F1CD0
Parameter3: %p, xrefs: 047F1DEE
heap_failure_invalid_argument, xrefs: 047F1CAD
heap_failure_entry_corruption, xrefs: 047F1C83
heap_failure_lfh_bitmap_mismatch, xrefs: 047F1CD7

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: b27e2d6349acfe27edad53c3ca0912ee667b4c2ad4c07f578bd6ebf04e84a645
Instruction ID: 400615e27f8825656a91954739899e7347f21aef53a37461c2b3cc37a5c9f78f
Opcode Fuzzy Hash: b27e2d6349acfe27edad53c3ca0912ee667b4c2ad4c07f578bd6ebf04e84a645
Instruction Fuzzy Hash: 5561F573650154DFE3219B89DE88E3573A4EB04A31F89847BFA096B312E674BC41DF0A

Uniqueness

Uniqueness Score: -1.00%

Function 04743D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E04743D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E04741B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E04741B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E04741B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E04741B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E04741B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L04754620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E0477F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E04781370(_t276, 0x4714e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E0477BB40(0,  &_v68, _t170);
									if(L047443C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E0477BB40(_t257,  &_v68, _t243);
								if(L047443C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E04781370(_t278, 0x4714e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L04754620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E0477F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E04781370(_v16, 0x4714e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E0477BB40(_t262,  &_v68, _t244);
								if(L047443C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E04781370(_t282, 0x4714e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E0477BB40(_t262,  &_v68, _t201);
							if(L047443C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L04754620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E0477F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E04781370(_t280, 0x4714e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E0477BB40(_t267,  &_v68, _t245);
							if(L047443C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E04781370(_t284, 0x4714e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E0477BB40(_t267,  &_v68, _t224);
						if(L047443C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x04743d3c
0x04743d42
0x04743d44
0x04743d46
0x04743d49
0x04743d4c
0x04743d4f
0x04743d52
0x04743d55
0x04743d58
0x04743d5b
0x04743d5f
0x04743d61
0x04743d66
0x04798213
0x04798218
0x04744085
0x04744088
0x0474408e
0x04744094
0x0474409a
0x047440a0
0x047440a6
0x047440a9
0x047440af
0x047440b6
0x047440bd
0x047440bd
0x04743d83
0x0479821f
0x04798229
0x04798238
0x04798238
0x0479823d
0x0479823d
0x04743da0
0x04743daf
0x04743db5
0x04743dba
0x04743dba
0x04743dd4
0x04743e94
0x04743eab
0x04743f6d
0x04743f84
0x0474406b
0x0474406b
0x0474406e
0x0474406e
0x04744070
0x04744074
0x04798351
0x04798351
0x0474407a
0x0474407f
0x0479835d
0x04798370
0x04798377
0x04798379
0x0479837c
0x0479837c
0x0479835d
0x00000000
0x0474407f
0x04743f8a
0x04743f8d
0x04743f90
0x04743f95
0x0479830d
0x0479830f
0x04743f9b
0x04743fac
0x04743fae
0x04743fb1
0x04743fb1
0x04743fb6
0x04798317
0x0479831a
0x00000000
0x04743fbc
0x04743fc1
0x04743fc9
0x04743fd7
0x04743fda
0x04743fdd
0x04744021
0x04744021
0x04744029
0x04744030
0x04744044
0x04744046
0x04744046
0x04744044
0x04744049
0x04798327
0x04798334
0x04798339
0x0479833c
0x0474404f
0x0474404f
0x0474404f
0x04744051
0x04744056
0x04744063
0x04744063
0x04744068
0x00000000
0x04744068
0x04743fdf
0x04743fe2
0x04743fe4
0x04743fe7
0x04743fef
0x04744003
0x04744005
0x04744005
0x0474400c
0x04744013
0x04744016
0x04744017
0x0474401b
0x0474401e
0x00000000
0x0474401e
0x04743fb6
0x04743eb1
0x04743eb4
0x04743eb7
0x04743ebc
0x047982a9
0x047982ab
0x04743ec2
0x04743ed3
0x04743ed5
0x04743ed8
0x04743ed8
0x04743edd
0x047982b3
0x047982b6
0x00000000
0x04743ee3
0x04743ee8
0x04743eed
0x04743ef0
0x04743ef3
0x04743f02
0x04743f05
0x04743f08
0x047982c0
0x047982c3
0x047982c5
0x047982c8
0x047982d0
0x047982e4
0x047982e6
0x047982e6
0x047982ed
0x047982f4
0x047982f7
0x047982f8
0x047982fc
0x047982ff
0x047982ff
0x04743f0e
0x04743f11
0x04743f16
0x04743f1d
0x04743f31
0x04798307
0x04798307
0x04743f31
0x04743f39
0x04743f48
0x04743f4d
0x04743f50
0x04743f50
0x04743f53
0x04743f58
0x04743f65
0x04743f65
0x04743f6a
0x00000000
0x04743f6a
0x04743edd
0x04743dda
0x04743ddd
0x04743de0
0x04743de5
0x04798245
0x04743deb
0x04743df7
0x04743dfc
0x04743dfe
0x04743e01
0x04743e01
0x04743e06
0x0479824d
0x0479824f
0x04798254
0x00000000
0x04743e0c
0x04743e11
0x04743e16
0x04743e19
0x04743e29
0x04743e2c
0x04743e2f
0x0479825c
0x0479825f
0x04798261
0x04798264
0x0479826c
0x04798280
0x04798282
0x04798282
0x04798289
0x04798290
0x04798293
0x04798294
0x04798298
0x0479829b
0x0479829b
0x04743e35
0x04743e38
0x04743e3d
0x04743e44
0x04743e58
0x047982a3
0x047982a3
0x04743e58
0x04743e60
0x04743e6f
0x04743e74
0x04743e77
0x04743e77
0x04743e7a
0x04743e7f
0x04743e8c
0x04743e8c
0x04743e91
0x00000000
0x04743e91

Strings

Kernel-MUI-Number-Allowed, xrefs: 04743D8C
Kernel-MUI-Language-Allowed, xrefs: 04743DC0
Kernel-MUI-Language-SKU, xrefs: 04743F70
WindowsExcludedProcs, xrefs: 04743D6F
Kernel-MUI-Language-Disallowed, xrefs: 04743E97

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: 3269b0782a845493076de6a9b4782b26053907c42d56fc5b660523f460d523f6
Instruction ID: f867bb5c22d54a744dd12022f59cbe3f65cec571fa2174d73a38e43708cdc648
Opcode Fuzzy Hash: 3269b0782a845493076de6a9b4782b26053907c42d56fc5b660523f460d523f6
Instruction Fuzzy Hash: F0F14D72D10218EBDF15DF98D984AEEBBB9FF49750F15046AE805A7310E770AE01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04768E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E04768E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x482d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x4828464; // 0x74e10110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x4825780 & 0x00000003) != 0) {
							E047B5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x4825780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E0477B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x4827984; // 0x802c38
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x4828464; // 0x74e10110
					 *0x482b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E04769B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x4825780 & 0x00000005) != 0) {
						_push(_t49);
						E047B5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x04768e0f
0x04768e16
0x04768e19
0x04768e1b
0x04768e21
0x04768e7f
0x04768e85
0x047a9354
0x047a936c
0x047a9371
0x047a937b
0x047a9381
0x047a9381
0x047a937b
0x04768e9d
0x04768e9d
0x04768e29
0x04768e2c
0x04768e38
0x04768e3e
0x04768e43
0x04768eb5
0x04768eb9
0x047a92aa
0x047a92af
0x047a92e8
0x047a92e8
0x047a92af
0x04768eb9
0x04768e45
0x04768e53
0x04768e5b
0x04768e5f
0x04768e78
0x04768e78
0x04768e7d
0x04768ec3
0x04768ecd
0x04768ed2
0x04768ed2
0x04768ec5
0x04768ec5
0x00000000
0x04768e7d
0x04768e67
0x04768ea4
0x047a931a
0x00000000
0x00000000
0x047a9320
0x04768ea4
0x04768e70
0x047a9325
0x047a9340
0x047a9345
0x047a9345
0x04768e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

LdrpFindDllActivationContext, xrefs: 047A9331, 047A935D
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 047A932A
minkernel\ntdll\ldrsnap.c, xrefs: 047A933B, 047A9367
Querying the active activation context failed with status 0x%08lx, xrefs: 047A9357

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 0-3779518884
Opcode ID: 56ac298431280765da0215c86135358667a1d334fa24c965aa3b549be60205e3
Instruction ID: 6cadcf52119969268d917153ce51e0803563af99e7c071d80057247519dceb08
Opcode Fuzzy Hash: 56ac298431280765da0215c86135358667a1d334fa24c965aa3b549be60205e3
Instruction Fuzzy Hash: 6A410672A42311AFDB31BF388849A75B2A7AB40308F0B8629ED0667350E7747C80C683

Uniqueness

Uniqueness Score: -1.00%

Function 04748794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E04748794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E0474934A() != 0) {
								_t159 = E047BA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0x4825780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E047B5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0x4825780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E0474849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E04748999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E04748999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0x4825c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0x4825c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E04752280(_t92, 0x48286cc);
															_t94 = E04809DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E047661A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0x4825c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E04748A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0x4825c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0x4825c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E0477F380(_t136, 0x4711184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E04752280(_t108, 0x48286cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E047661A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E04809D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E0474FFB0(_t118, _t156, 0x48286cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E04779A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x04748799
0x0474879d
0x047487a1
0x047487a3
0x047487a8
0x047487c3
0x047487c3
0x047487c8
0x047487d1
0x047487d4
0x047487d8
0x047487e5
0x047487ec
0x04799bfe
0x04799c00
0x04799c02
0x04799c08
0x04799c0d
0x04799c0f
0x04799c14
0x04799c2d
0x04799c32
0x04799c37
0x04799c3a
0x04799c3c
0x04799c42
0x04799c42
0x04799c3c
0x04799c02
0x047487da
0x047487df
0x047487e3
0x00000000
0x00000000
0x047487e3
0x047487f2
0x00000000
0x047487fb
0x047487fd
0x047487fe
0x0474880e
0x0474880f
0x04748810
0x04748814
0x0474881a
0x0474881c
0x0474881f
0x04748821
0x04748822
0x04748824
0x04748826
0x0474882c
0x0474882e
0x04799c48
0x04799c48
0x04748834
0x04748834
0x04748837
0x00000000
0x00000000
0x04748837
0x0474882e
0x0474883d
0x04748840
0x04748843
0x04748846
0x04748849
0x0474884c
0x0474884e
0x04748850
0x04748852
0x04748854
0x04748857
0x047488b4
0x047488b6
0x047488b6
0x04748859
0x04748859
0x04748859
0x04748861
0x04748866
0x0474886a
0x0474893d
0x04748941
0x00000000
0x04748947
0x04748947
0x0474894a
0x0474894c
0x00000000
0x04748952
0x04748955
0x0474895a
0x0474895d
0x0474895d
0x0474895f
0x04748961
0x04748961
0x04748968
0x00000000
0x00000000
0x0474896a
0x0474896b
0x0474896e
0x00000000
0x04748970
0x04748970
0x04748970
0x04748970
0x04748972
0x04748972
0x04748974
0x00000000
0x0474897a
0x0474897a
0x0474897d
0x00000000
0x04748983
0x04799c65
0x04799c6d
0x04799c72
0x04799c75
0x04799c75
0x04799c82
0x04799c86
0x04799c87
0x04799c88
0x04799c89
0x04799c8c
0x04799c90
0x04799c95
0x04799c97
0x04799ca0
0x04799ca3
0x04799ca9
0x04799ca9
0x00000000
0x04799ca9
0x04799ca3
0x00000000
0x04799c97
0x0474897d
0x00000000
0x04748974
0x04748988
0x04748992
0x04748996
0x00000000
0x04748996
0x0474894c
0x00000000
0x04748870
0x0474887b
0x0474887d
0x0474887f
0x04748881
0x04748884
0x04748884
0x04748886
0x04748889
0x0474888c
0x0474888e
0x04748891
0x04748891
0x04748898
0x00000000
0x00000000
0x0474889a
0x0474889b
0x0474889e
0x00000000
0x00000000
0x047488a0
0x047488a8
0x047488b0
0x047488b2
0x047488d3
0x047488d5
0x00000000
0x047488d7
0x047488db
0x047488dc
0x047488e0
0x047488e8
0x047488ee
0x047488f0
0x047488f3
0x047488fc
0x04748901
0x04748906
0x0474890c
0x0474890c
0x0474890f
0x04748916
0x04748917
0x04748918
0x04748919
0x0474891a
0x0474891f
0x04748921
0x04799c52
0x04799c55
0x04799c5b
0x04799cac
0x04799cc0
0x04799cc0
0x04799c55
0x04748927
0x04748927
0x0474892f
0x04748933
0x00000000
0x047488f5
0x047488f5
0x00000000
0x047488f7
0x047488f7
0x047488fa
0x00000000
0x00000000
0x00000000
0x00000000
0x047488fa
0x047488f5
0x047488f3
0x00000000
0x047488d5
0x00000000
0x047488b2
0x047488c9
0x00000000
0x047488c9
0x0474887f
0x0474886a
0x04748857
0x04748852
0x047488bf
0x047488bf
0x047487aa
0x047487ad
0x047487ae
0x047487b4
0x047487b5
0x047487b6
0x047487b8
0x047487bd
0x047487c1
0x047487f4
0x047487fa
0x00000000
0x00000000
0x00000000
0x047487c1
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 04799C28
LdrpDoPostSnapWork, xrefs: 04799C1E
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 04799C18

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 26b91a085841601c632b183330a3e5d980f3330dc5037e77ad31eedbd2722358
Instruction ID: 317b3e901e8e73a01e6c7a573549e9d6631037a0dc65ac37ba77000b24ef7f3f
Opcode Fuzzy Hash: 26b91a085841601c632b183330a3e5d980f3330dc5037e77ad31eedbd2722358
Instruction Fuzzy Hash: AF9128B5A10219DFEF18EF99C88097A73B9FF84354B064569E901AB350E730FD41CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04747E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E04747E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E0474CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E0473C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0x4825780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E047B5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0x4825780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E04757D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04757D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E047B7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E04757D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E04757D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E047B7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E0476A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E0473B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x04747e4c
0x04747e50
0x04747e55
0x04747e58
0x04747e5d
0x04747e71
0x04747f33
0x04747e77
0x04747e77
0x04747e79
0x04747e79
0x04747e7e
0x04747f45
0x04799848
0x00000000
0x04799848
0x04747f4e
0x04747f53
0x04747f5a
0x00000000
0x00000000
0x0479985a
0x04799862
0x04799866
0x00000000
0x0479986c
0x00000000
0x0479986c
0x04747e84
0x04747e84
0x04747e8d
0x04799871
0x04747eb8
0x04747ec0
0x04747ec0
0x04747e9a
0x0479987e
0x00000000
0x00000000
0x04799884
0x0479988b
0x047998a7
0x047998ac
0x047998b1
0x047998b6
0x047998b8
0x047998b8
0x047998b9
0x00000000
0x047998b9
0x04747ea0
0x04747ea7
0x00000000
0x00000000
0x04747eac
0x04747eb1
0x04747ec6
0x04747ed0
0x047998cc
0x04747ed6
0x04747ed6
0x04747ed6
0x04747ede
0x04747ee3
0x047998e3
0x047998f0
0x04799902
0x047998f2
0x047998fb
0x047998fb
0x04799907
0x0479991d
0x0479991d
0x04799907
0x047998e3
0x04747ef0
0x04747f14
0x04747f14
0x04747f1e
0x04799946
0x04747f24
0x04747f24
0x04747f24
0x04747f2c
0x0479996a
0x04799975
0x04799975
0x0479997e
0x04799993
0x04799993
0x0479997e
0x00000000
0x04747ef2
0x04747efc
0x04747f0a
0x04747f0e
0x04799933
0x00000000
0x04799933
0x00000000
0x04747f0e
0x00000000
0x00000000
0x00000000
0x04747eb1

Strings

LdrpCompleteMapModule, xrefs: 04799898
minkernel\ntdll\ldrmap.c, xrefs: 047998A2
Could not validate the crypto signature for DLL %wZ, xrefs: 04799891

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 09c7cebb63077eac97fdf584e8a119cd911df49ffa92761ed06af2ce2822f061
Instruction ID: 8b146751ba40099a107954bc6555326b1b197840579f5ab78b23c33b84a2d5d7
Opcode Fuzzy Hash: 09c7cebb63077eac97fdf584e8a119cd911df49ffa92761ed06af2ce2822f061
Instruction Fuzzy Hash: 3451F0B16007419FEB29CF69C944B3AB7E4EB80314F040699E9519B7E1E774FE01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0473E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0473E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E0473F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E047795D0();
						}
						if(_t78 != 0) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E0477FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E0477BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E04779600();
					if(_t97 < 0) {
						goto L6;
					}
					E0477BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L0473F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E0477BB40(_t83, _t102 + 0x24, _t78);
								if(L047443C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E0477BB40(_t84, _t102 + 0x24, _t94);
									if(L047443C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x0473e620
0x0473e628
0x0473e62f
0x0473e631
0x0473e635
0x0473e637
0x0473e63e
0x04795503
0x04795503
0x0473e64c
0x0473e64c
0x0473e651
0x00000000
0x00000000
0x0473e661
0x0473e665
0x0479542a
0x0473e715
0x0473e71a
0x0473e71c
0x0473e720
0x0473e720
0x0473e727
0x0473e736
0x0473e736
0x0473e743
0x0473e743
0x0473e673
0x0473e678
0x0473e67d
0x0473e682
0x0473e685
0x0473e692
0x0473e69b
0x0473e6a3
0x0473e6ad
0x0473e6b1
0x0473e6b2
0x0473e6bb
0x0473e6bf
0x0473e6c0
0x0473e6c8
0x0473e6cc
0x0473e6d5
0x0473e6d9
0x00000000
0x00000000
0x0473e6e5
0x0473e6ea
0x0473e6f9
0x0473e70b
0x0473e70f
0x04795439
0x0479545e
0x0479545e
0x00000000
0x0479545e
0x0479543b
0x0479543e
0x04795440
0x04795445
0x04795472
0x04795475
0x0479548d
0x04795493
0x047954a9
0x00000000
0x00000000
0x047954ab
0x047954b4
0x047954bc
0x047954c8
0x047954de
0x047954fb
0x047954e0
0x047954e6
0x047954eb
0x047954eb
0x047954de
0x00000000
0x047954bc
0x04795477
0x0479547a
0x04795480
0x04795483
0x04795486
0x0479548b
0x00000000
0x00000000
0x00000000
0x0479548b
0x00000000
0x00000000
0x00000000
0x00000000
0x04795447
0x04795447
0x04795447
0x04795447
0x0479544e
0x00000000
0x00000000
0x04795450
0x04795452
0x04795455
0x0479545a
0x00000000
0x00000000
0x00000000
0x0479545c
0x0479546a
0x0479546d
0x0479546f
0x00000000
0x0479546f
0x0473e70f

Strings

\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 0473E68C
@, xrefs: 0473E6C0
InstallLanguageFallback, xrefs: 0473E6DB

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: a052feff544c0670396db8c117be834c5e67b4221234c1c0b3a0b8a2cee306ca
Instruction ID: 87db6612b05d5713d05eb652d3b9279e3ed00d492799b73b9df51fc4be3cec91
Opcode Fuzzy Hash: a052feff544c0670396db8c117be834c5e67b4221234c1c0b3a0b8a2cee306ca
Instruction Fuzzy Hash: 3651BFB2508325ABDB11DF24D444A6BB3E8AF88759F45092EF985E7350F734EE04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 047B51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E047B51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0x48105f0);
				E0478D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E0474EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E047B53CA(0);
						return E0478D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E0477F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E04753690(1, _t117, 0x4711810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E0477AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L04754620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E0477AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E047B500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E04779860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x047b51be
0x047b51c3
0x047b51c8
0x047b51cd
0x047b51d0
0x047b51d3
0x047b51d8
0x047b51db
0x047b51de
0x047b51e0
0x047b51e3
0x047b51e6
0x047b51e8
0x047b5342
0x047b5351
0x047b5356
0x047b535a
0x047b5360
0x047b5363
0x047b5366
0x047b5369
0x047b5369
0x047b536b
0x047b536b
0x047b5370
0x047b53a3
0x047b53a4
0x047b53a6
0x047b53ab
0x047b53ab
0x047b53ae
0x047b53ae
0x047b53b5
0x047b53bf
0x047b53bf
0x047b5375
0x047b5396
0x047b53a0
0x047b53a0
0x00000000
0x047b5396
0x047b5377
0x047b5379
0x047b537f
0x047b538c
0x047b5390
0x00000000
0x047b5390
0x047b51ee
0x047b51f1
0x047b5301
0x047b5310
0x047b5315
0x047b5318
0x047b531b
0x047b5320
0x047b532e
0x047b5331
0x00000000
0x047b5331
0x047b5328
0x047b5329
0x00000000
0x047b5329
0x047b51fa
0x047b5235
0x047b5236
0x047b5239
0x047b523f
0x047b5240
0x047b5241
0x047b5242
0x047b5246
0x047b5247
0x047b524e
0x047b5251
0x047b5267
0x047b5269
0x047b526e
0x047b527d
0x047b527e
0x047b5281
0x047b5282
0x047b5287
0x047b5288
0x047b528a
0x047b528f
0x047b5294
0x00000000
0x00000000
0x047b529a
0x047b529c
0x047b529e
0x047b529e
0x047b52a4
0x047b52b0
0x00000000
0x00000000
0x047b52ba
0x047b52bc
0x047b52bc
0x047b52d4
0x047b52d9
0x047b52dc
0x047b52e1
0x00000000
0x00000000
0x047b52e7
0x047b52f4
0x00000000
0x047b52f4
0x047b5270
0x00000000
0x047b5270
0x047b51fc
0x047b51fd
0x047b5202
0x047b5203
0x047b5205
0x047b520a
0x047b520f
0x00000000
0x00000000
0x047b521b
0x047b5226
0x047b522b
0x047b521d
0x047b521d
0x047b5222
0x047b5222
0x047b522d
0x00000000

Strings

UEFI, xrefs: 047B521D
Legacy, xrefs: 047B5226

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 32d5341f9382f1e75b2510c018599db28a299ea05b992030eec3537abe1f6984
Instruction ID: f075e8c1e396bb61b177634f6381bce5557826f0e8b7c1b5dad721bb4a148757
Opcode Fuzzy Hash: 32d5341f9382f1e75b2510c018599db28a299ea05b992030eec3537abe1f6984
Instruction Fuzzy Hash: 87515DB1A04708AFEB24DFA9C940BEDB7F8FB48708F54442DE589EB351D671A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0473B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0473B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0x480f7a8);
				E0478D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E0478D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E0477D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E0477F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L0478DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E0477B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E0477B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E0477E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E0477A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x0473b171
0x0473b171
0x0473b171
0x0473b171
0x0473b171
0x0473b176
0x0473b17b
0x0473b180
0x0473b186
0x0473b18f
0x0473b198
0x0473b1a4
0x0473b1aa
0x04794802
0x04794802
0x04794805
0x0479480c
0x0479480e
0x0473b1d1
0x0473b1d3
0x0473b1de
0x0473b1de
0x04794817
0x0479481e
0x04794820
0x04794822
0x04794822
0x04794824
0x04794824
0x0479482a
0x00000000
0x00000000
0x04794835
0x0479483a
0x0479483d
0x0479483f
0x04794842
0x04794842
0x04794842
0x04794846
0x0479484c
0x0479484e
0x04794851
0x04794851
0x04794853
0x04794854
0x04794854
0x04794858
0x0479485a
0x0479485a
0x0479485d
0x0479485f
0x04794861
0x04794861
0x04794866
0x0479486b
0x0479486e
0x04794871
0x04794876
0x04794876
0x04794878
0x0479487b
0x04794884
0x04794884
0x00000000
0x0479487d
0x0479487d
0x04794882
0x04794889
0x04794889
0x0479488f
0x04794891
0x047948e0
0x047948e2
0x047948e4
0x047948e4
0x047948e7
0x047948e7
0x047948ed
0x047948f4
0x047948f6
0x04794951
0x04794951
0x04794953
0x04794953
0x04794956
0x04794956
0x04794958
0x04794959
0x04794959
0x0479495d
0x0479495d
0x0479495f
0x0479495f
0x04794965
0x04794969
0x047949ba
0x047949ba
0x047949c1
0x047949c5
0x047949cc
0x047949d4
0x047949d7
0x047949da
0x047949e4
0x047949e5
0x047949f3
0x04794a02
0x00000000
0x04794a02
0x04794972
0x04794974
0x00000000
0x00000000
0x04794976
0x04794979
0x04794982
0x04794983
0x04794984
0x0479498b
0x0479498d
0x04794991
0x04794993
0x04794999
0x0479499d
0x047949a2
0x047949a2
0x047949a2
0x04794999
0x047949ac
0x00000000
0x047949b3
0x047948f8
0x047948fe
0x00000000
0x00000000
0x00000000
0x047948fe
0x04794895
0x0479489c
0x047948ad
0x047948b2
0x047948b5
0x047948b7
0x047948ba
0x047948bc
0x047948c6
0x047948c6
0x047948cb
0x047948d1
0x047948d4
0x047948d8
0x047948d8
0x00000000
0x047948d8
0x047948be
0x047948c0
0x00000000
0x00000000
0x047948c2
0x00000000
0x00000000
0x00000000
0x047948c4
0x00000000
0x04794882
0x0479487b
0x04794904
0x04794906
0x00000000
0x00000000
0x04794908
0x0479490e
0x00000000
0x00000000
0x04794910
0x04794917
0x04794917
0x00000000
0x04794917
0x0473b1ba
0x047947f9
0x047947fc
0x00000000
0x00000000
0x00000000
0x047947fc
0x0473b1c0
0x0473b1c0
0x0473b1c3
0x0473b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 047948AD

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: f705c72a40cffbac435c4fe6b184869a7bef50bfa0465f1053b83c341639cc86
Instruction ID: 9c742db512a9e34713d5843f17679959134ace2dca6f964a22a7faec7190934c
Opcode Fuzzy Hash: f705c72a40cffbac435c4fe6b184869a7bef50bfa0465f1053b83c341639cc86
Instruction Fuzzy Hash: 1A51C071E082598EEF31CF64D845BBEBBF0AF04724F1041ADD859AB381D7746D429B91

Uniqueness

Uniqueness Score: -1.00%

Function 0475B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0475B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0x482d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E04757D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E04808CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E04779E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E0477B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E0477CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E04757D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E04808F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E0477AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0x4828628; // 0x0
								_v68 = _t77;
								_t78 =  *0x482862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0x4828628; // 0x0
							_t116 =  *0x482862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x0475b94c
0x0475b956
0x0475b95c
0x0475b95e
0x0475b964
0x0475b969
0x0475b96d
0x0475b96d
0x0475b970
0x0475b974
0x0475b97a
0x0475badf
0x0475badf
0x0475bae2
0x0475bae4
0x0475bae6
0x0475baf0
0x047a2cb8
0x0475baf6
0x0475baf6
0x0475baf6
0x0475bafd
0x0475bb1f
0x0475bb1f
0x0475baff
0x0475bb00
0x0475bb00
0x0475bb03
0x0475bb03
0x0475bacb
0x0475bacf
0x0475bad0
0x0475bad1
0x0475badc
0x0475badc
0x0475b980
0x0475b980
0x0475b988
0x0475b98b
0x0475b98d
0x0475b990
0x0475b993
0x0475b999
0x0475b99b
0x0475b9a1
0x0475b9a5
0x0475b9aa
0x0475b9b0
0x0475b9bb
0x0475b9c0
0x0475b9c3
0x0475b9ca
0x0475b9cc
0x0475b9cf
0x0475b9d3
0x0475b9d7
0x0475ba94
0x0475ba94
0x0475ba98
0x0475baa3
0x047a2ccb
0x0475baa9
0x0475baa9
0x0475baa9
0x0475bab1
0x047a2cd5
0x047a2cdd
0x047a2cdd
0x0475babb
0x0475babc
0x0475bac2
0x0475bac3
0x0475bac3
0x0475bac6
0x00000000
0x0475b9dd
0x0475b9dd
0x0475b9e7
0x0475b9e7
0x0475b9ec
0x0475b9ec
0x0475b9f1
0x0475b9f5
0x0475b9fa
0x0475ba00
0x0475ba0c
0x0475ba10
0x0475ba10
0x0475ba12
0x0475ba18
0x00000000
0x00000000
0x0475bb26
0x0475bb26
0x0475ba1e
0x0475ba1e
0x0475ba23
0x0475ba25
0x0475ba2c
0x0475ba30
0x0475ba35
0x0475ba35
0x0475ba41
0x0475ba46
0x0475ba4c
0x0475ba50
0x0475ba54
0x0475ba6a
0x0475ba6e
0x0475ba70
0x0475ba74
0x0475ba78
0x0475ba7a
0x0475ba7c
0x0475ba8e
0x0475ba90
0x0475ba92
0x0475bb14
0x0475bb14
0x0475bb16
0x0475bb16
0x00000000
0x0475ba7c
0x0475bb0a
0x0475bb0d
0x00000000
0x00000000
0x00000000
0x0475bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0475B9A5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: b2cf923a61b3e41014250c5f6ffabee6f99e29f623fc78d3c37fc718b87369b8
Instruction ID: 605ed72424ee15a4e542068490ab1035fa78f256d1a0f0f8a452e5b8d859eb58
Opcode Fuzzy Hash: b2cf923a61b3e41014250c5f6ffabee6f99e29f623fc78d3c37fc718b87369b8
Instruction Fuzzy Hash: 05514671A08340CFD720DF29C48492ABBE5FB88604F54896EF9858B365E7B1FD44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04762581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E04762581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t236;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t247;
				signed int _t249;
				intOrPtr _t251;
				signed int _t254;
				signed int _t261;
				signed int _t264;
				signed int _t274;
				intOrPtr _t280;
				signed int _t282;
				signed int _t284;
				void* _t285;
				signed int _t286;
				unsigned int _t289;
				signed int _t293;
				signed int _t295;
				signed int _t299;
				intOrPtr _t311;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t327;
				signed int _t328;
				void* _t330;
				signed int _t331;
				signed int _t333;
				signed int _t336;
				signed int _t337;

				_t333 = _t336;
				_t337 = _t336 - 0x4c;
				_v8 =  *0x482d360 ^ _t333;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t327 = 0x482b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t289 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t280 = 0x48;
				_t309 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t320 = 0;
				_v37 = _t309;
				if(_v48 <= 0) {
					L16:
					_t45 = _t280 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t328 = 0xc0000106;
						goto L32;
					} else {
						_t327 = L04754620(_t289,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t280);
						_v52 = _t327;
						__eflags = _t327;
						if(_t327 == 0) {
							_t328 = 0xc0000017;
							goto L32;
						} else {
							 *(_t327 + 0x44) =  *(_t327 + 0x44) & 0x00000000;
							_t50 = _t327 + 0x48; // 0x48
							_t322 = _t50;
							_t309 = _v32;
							 *((intOrPtr*)(_t327 + 0x3c)) = _t280;
							_t282 = 0;
							 *((short*)(_t327 + 0x30)) = _v48;
							__eflags = _t309;
							if(_t309 != 0) {
								 *(_t327 + 0x18) = _t322;
								__eflags = _t309 - 0x4828478;
								 *_t327 = ((0 | _t309 == 0x04828478) - 0x00000001 & 0xfffffffb) + 7;
								E0477F3E0(_t322,  *((intOrPtr*)(_t309 + 4)),  *_t309 & 0x0000ffff);
								_t309 = _v32;
								_t337 = _t337 + 0xc;
								_t282 = 1;
								__eflags = _a8;
								_t322 = _t322 + (( *_t309 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t274 = E047C39F2(_t322);
									_t309 = _v32;
									_t322 = _t274;
								}
							}
							_t293 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t328 = _v68;
								__eflags = 0;
								 *((short*)(_t322 - 2)) = 0;
								goto L32;
							} else {
								_t284 = _t327 + _t282 * 4;
								_v56 = _t284;
								do {
									__eflags = _t309;
									if(_t309 != 0) {
										_t236 =  *(_v60 + _t293 * 4);
										__eflags = _t236;
										if(_t236 == 0) {
											goto L30;
										} else {
											__eflags = _t236 == 5;
											if(_t236 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t284 =  *(_v60 + _t293 * 4);
										 *(_t284 + 0x18) = _t322;
										_t240 =  *(_v60 + _t293 * 4);
										__eflags = _t240 - 8;
										if(__eflags > 0) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t240 * 4 +  &M04762959))) {
												case 0:
													__ax =  *0x4828488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E0477F3E0(__edi,  *0x482848c, __ax & 0x0000ffff);
														__eax =  *0x4828488 & 0x0000ffff;
														goto L26;
													}
													goto L122;
												case 1:
													L45:
													E0477F3E0(_t322, _v80, _v64);
													_t269 = _v64;
													goto L26;
												case 2:
													 *0x4828480 & 0x0000ffff = E0477F3E0(__edi,  *0x4828484,  *0x4828480 & 0x0000ffff);
													__eax =  *0x4828480 & 0x0000ffff;
													__eax = ( *0x4828480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E0477F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L122;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E0477F3E0(_t322, _v76, _v36);
														_t269 = _v36;
													}
													L26:
													_t337 = _t337 + 0xc;
													_t322 = _t322 + (_t269 >> 1) * 2 + 2;
													__eflags = _t322;
													L27:
													_push(0x3b);
													_pop(_t271);
													 *((short*)(_t322 - 2)) = _t271;
													goto L28;
												case 6:
													__ebx = "\\Wow\\Wow";
													__eflags = __ebx - "\\Wow\\Wow";
													if(__ebx != "\\Wow\\Wow") {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E0477F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - "\\Wow\\Wow";
														} while (__ebx != "\\Wow\\Wow");
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x4828478 & 0x0000ffff = E0477F3E0(__edi,  *0x482847c,  *0x4828478 & 0x0000ffff);
													__eax =  *0x4828478 & 0x0000ffff;
													__eax = ( *0x4828478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E047C39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x4826e58 & 0x0000ffff = E0477F3E0(__edi,  *0x4826e5c,  *0x4826e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x4826e58 & 0x0000ffff;
													__eax = ( *0x4826e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t293 = _v16;
													_t309 = _v32;
													L29:
													_t284 = _t284 + 4;
													__eflags = _t284;
													_v56 = _t284;
													goto L30;
											}
										}
									}
									goto L122;
									L30:
									_t293 = _t293 + 1;
									_v16 = _t293;
									__eflags = _t293 - _v48;
								} while (_t293 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t240 =  *(_v60 + _t320 * 4);
						if(_t240 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t240 * 4 +  &M04762935))) {
							case 0:
								__ax =  *0x4828488;
								__eflags = __ax;
								if(__eflags != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t309 =  &_v64;
								_v80 = E04762E3E(0,  &_v64);
								_t280 = _t280 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x4828480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x4828480;
									goto L94;
								}
								goto L14;
							case 3:
								__eax = E0474EEF0(0x48279a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L71();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E0474EB70(__ecx, 0x48279a0);
									__eflags = __esi - 0xc0000100;
									if(__eflags == 0) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t214 = _v72;
											__eflags = _t214;
											if(_t214 != 0) {
												L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t214);
											}
											_t215 = _v52;
											__eflags = _t215;
											if(_t215 != 0) {
												__eflags = _t328;
												if(_t328 < 0) {
													L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t215);
													_t215 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t289 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x4827b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E0474EB70(__ecx, 0x48279a0);
										__eax = _v52;
										L36:
										_pop(_t321);
										_pop(_t329);
										__eflags = _v8 ^ _t333;
										_pop(_t281);
										return E0477B640(_t215, _t281, _v8 ^ _t333, _t309, _t321, _t329);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L71();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L122;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t276 = _v56;
								if(_v56 != 0) {
									_t309 =  &_v36;
									_t278 = E04762E3E(_t276,  &_v36);
									_t289 = _v36;
									_v76 = _t278;
								}
								if(_t289 == 0) {
									goto L44;
								} else {
									_t280 = _t280 + 2 + _t289;
								}
								goto L14;
							case 6:
								__eax =  *0x4825764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x4828478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__eflags != 0) {
									__eax = 0x4828478;
									L94:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x4826e58 & 0x0000ffff;
								__eax = ( *0x4826e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t320 = _t320 + 1;
								if(_t320 >= _v48) {
									goto L16;
								} else {
									_t309 = _v37;
									goto L1;
								}
								goto L122;
						}
					}
					L56:
					_push(0x25);
					asm("int 0x29");
					asm("out 0x28, al");
					if(__eflags > 0) {
						asm("o16 sub [esi+0x4], dh");
					}
					asm("loopne 0x29");
					if(__eflags <= 0 || __eflags > 0) {
						_t327 = _t327 + 1;
						_t105 = _t327 + 4;
						 *_t105 =  *(_t327 + 4) - _t309;
						__eflags =  *_t105;
					}
					_t241 = _t240 + 0x1f047626;
					__eflags = _t241;
					_pop(_t285);
					if(_t241 == 0) {
						_t107 = _t241;
						_t241 = _t337;
						_t337 = _t107;
						_t108 = _t327 + 4;
						 *_t108 =  *(_t327 + 4) - _t309;
						__eflags =  *_t108;
					}
					_t242 = _t241 ^ 0x02047a5b;
					 *(_t327 + 4) =  *(_t327 + 4) - _t327;
					 *_t242 =  *_t242 - 0x76;
					_t243 = _t242 + 0xf6;
					__eflags = _t243;
					asm("daa");
					if(_t243 > 0) {
						_push(ds);
						_t112 = _t327 + 4;
						 *_t112 =  *(_t327 + 4) - _t309;
						__eflags =  *_t112;
					}
					_t330 = _t327 - 1;
					_t114 = _t330 + 4;
					 *_t114 =  *(_t330 + 4) - _t309;
					__eflags =  *_t114;
					asm("daa");
					if(__eflags > 0) {
						asm("fcomp dword [ebx+0x7a]");
						__eflags = _t243 + 0xb4;
					}
					if(__eflags <= 0) {
						L69:
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
					} else {
						__eflags = 0x74;
						if(0x74 == 0) {
							goto L69;
						}
					}
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x480ff00);
					E0478D08C(_t285, _t322, _t330);
					_v44 =  *[fs:0x18];
					_t323 = 0;
					 *_a24 = 0;
					_t286 = _a12;
					__eflags = _t286;
					if(_t286 == 0) {
						_t247 = 0xc0000100;
					} else {
						_v8 = 0;
						_t331 = 0xc0000100;
						_v52 = 0xc0000100;
						_t249 = 4;
						while(1) {
							_v40 = _t249;
							__eflags = _t249;
							if(_t249 == 0) {
								break;
							}
							_t299 = _t249 * 0xc;
							_v48 = _t299;
							__eflags = _t286 -  *((intOrPtr*)(_t299 + 0x4711664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t264 = E0477E5C0(_a8,  *((intOrPtr*)(_t299 + 0x4711668)), _t286);
									_t337 = _t337 + 0xc;
									__eflags = _t264;
									if(__eflags == 0) {
										_t331 = E047B51BE(_t286,  *((intOrPtr*)(_v48 + 0x471166c)), _a16, _t323, _t331, __eflags, _a20, _a24);
										_v52 = _t331;
										break;
									} else {
										_t249 = _v40;
										goto L76;
									}
									goto L84;
								} else {
									L76:
									_t249 = _t249 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t331;
						__eflags = _t331;
						if(_t331 < 0) {
							__eflags = _t331 - 0xc0000100;
							if(_t331 == 0xc0000100) {
								_t295 = _a4;
								__eflags = _t295;
								if(_t295 != 0) {
									_v36 = _t295;
									__eflags =  *_t295 - _t323;
									if( *_t295 == _t323) {
										_t331 = 0xc0000100;
										goto L90;
									} else {
										_t311 =  *((intOrPtr*)(_v44 + 0x30));
										_t251 =  *((intOrPtr*)(_t311 + 0x10));
										__eflags =  *((intOrPtr*)(_t251 + 0x48)) - _t295;
										if( *((intOrPtr*)(_t251 + 0x48)) == _t295) {
											__eflags =  *(_t311 + 0x1c);
											if( *(_t311 + 0x1c) == 0) {
												L120:
												_t331 = E04762AE4( &_v36, _a8, _t286, _a16, _a20, _a24);
												_v32 = _t331;
												__eflags = _t331 - 0xc0000100;
												if(_t331 != 0xc0000100) {
													goto L83;
												} else {
													_t323 = 1;
													_t295 = _v36;
													goto L89;
												}
											} else {
												_t254 = E04746600( *(_t311 + 0x1c));
												__eflags = _t254;
												if(_t254 != 0) {
													goto L120;
												} else {
													_t295 = _a4;
													goto L89;
												}
											}
										} else {
											L89:
											_t331 = E04762C50(_t295, _a8, _t286, _a16, _a20, _a24, _t323);
											L90:
											_v32 = _t331;
											goto L83;
										}
									}
									goto L122;
								} else {
									E0474EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t331 = _a24;
									_t261 = E04762AE4( &_v36, _a8, _t286, _a16, _a20, _t331);
									_v32 = _t261;
									__eflags = _t261 - 0xc0000100;
									if(_t261 == 0xc0000100) {
										_v32 = E04762C50(_v36, _a8, _t286, _a16, _a20, _t331, 1);
									}
									_v8 = _t323;
									E04762ACB();
								}
							}
						}
						L83:
						_v8 = 0xfffffffe;
						_t247 = _t331;
					}
					L84:
					return E0478D0D1(_t247);
				}
				L122:
			}

0x04762584
0x04762586
0x04762590
0x04762596
0x04762597
0x04762598
0x04762599
0x0476259e
0x047625a4
0x047625a9
0x047625ac
0x047625ae
0x047625b1
0x047625b2
0x047625b5
0x047625b8
0x047625bb
0x047625bc
0x047625bf
0x047625c2
0x047625c5
0x047625c6
0x047625cb
0x047625ce
0x047625d8
0x047625dd
0x047625de
0x047625e1
0x047625e3
0x047625e9
0x047626da
0x047626da
0x047626dd
0x047626e2
0x047a5b56
0x00000000
0x047626e8
0x047626f9
0x047626fb
0x047626fe
0x04762700
0x047a5b60
0x00000000
0x04762706
0x04762706
0x0476270a
0x0476270a
0x0476270d
0x04762713
0x04762716
0x04762718
0x0476271c
0x0476271e
0x047a5b6c
0x047a5b6f
0x047a5b7f
0x047a5b89
0x047a5b8e
0x047a5b93
0x047a5b96
0x047a5b9c
0x047a5ba0
0x047a5ba3
0x047a5bab
0x047a5bb0
0x047a5bb3
0x047a5bb3
0x047a5ba3
0x04762724
0x04762726
0x04762729
0x0476272c
0x0476279d
0x0476279d
0x047627a0
0x047627a2
0x00000000
0x0476272e
0x0476272e
0x04762731
0x04762734
0x04762734
0x04762736
0x047a5bc1
0x047a5bc1
0x047a5bc4
0x00000000
0x047a5bca
0x047a5bca
0x047a5bcd
0x00000000
0x047a5bd3
0x00000000
0x047a5bd3
0x047a5bcd
0x0476273c
0x0476273c
0x04762742
0x04762747
0x0476274a
0x0476274d
0x04762750
0x00000000
0x04762756
0x04762756
0x00000000
0x04762902
0x04762908
0x0476290b
0x00000000
0x04762911
0x0476291c
0x04762921
0x00000000
0x04762921
0x00000000
0x00000000
0x04762880
0x04762887
0x0476288c
0x00000000
0x00000000
0x04762805
0x0476280a
0x04762814
0x04762816
0x00000000
0x00000000
0x0476281e
0x04762821
0x04762823
0x00000000
0x04762829
0x04762829
0x04762831
0x0476283c
0x0476283e
0x00000000
0x0476283e
0x00000000
0x00000000
0x0476284e
0x04762850
0x04762851
0x04762854
0x04762857
0x0476285a
0x0476285c
0x0476285d
0x00000000
0x00000000
0x0476275d
0x04762761
0x00000000
0x04762767
0x0476276e
0x04762773
0x04762773
0x04762776
0x04762778
0x0476277e
0x0476277e
0x04762781
0x04762781
0x04762783
0x04762784
0x00000000
0x00000000
0x047a5bd8
0x047a5bde
0x047a5be4
0x047a5be6
0x047a5be8
0x047a5be9
0x047a5bee
0x047a5bf8
0x047a5bff
0x047a5c01
0x047a5c04
0x047a5c07
0x047a5c0b
0x047a5c0d
0x047a5c0d
0x047a5c15
0x047a5c18
0x047a5c1b
0x047a5c1b
0x047a5c1e
0x00000000
0x00000000
0x047628c3
0x047628c8
0x047628d2
0x047628d4
0x047628d8
0x047628db
0x047a5c26
0x047a5c28
0x047a5c2d
0x047a5c2d
0x00000000
0x00000000
0x047a5c34
0x047a5c36
0x047a5c49
0x047a5c4e
0x047a5c54
0x047a5c5b
0x047a5c5d
0x047a5c60
0x04762788
0x04762788
0x0476278b
0x0476278e
0x0476278e
0x0476278e
0x04762791
0x00000000
0x00000000
0x04762756
0x04762750
0x00000000
0x04762794
0x04762794
0x04762795
0x04762798
0x04762798
0x00000000
0x04762734
0x0476272c
0x04762700
0x047625ef
0x047625ef
0x047625ef
0x047625f2
0x047625f8
0x00000000
0x00000000
0x047625fe
0x00000000
0x047628e6
0x047628ec
0x047628ef
0x047628f5
0x047628f8
0x047628f8
0x00000000
0x047628f8
0x00000000
0x00000000
0x04762866
0x04762866
0x04762876
0x04762879
0x00000000
0x00000000
0x047627e0
0x047627e7
0x047627e9
0x047627eb
0x047a5afd
0x00000000
0x047a5afd
0x00000000
0x00000000
0x04762633
0x04762638
0x0476263b
0x0476263c
0x0476263e
0x04762640
0x04762642
0x04762647
0x04762649
0x0476264e
0x04762650
0x04762653
0x04762659
0x047626a2
0x047626a7
0x047626ac
0x047626b2
0x047a5b11
0x047a5b15
0x047a5b17
0x00000000
0x047626b8
0x047626b8
0x047626ba
0x047627a6
0x047627a6
0x047627a9
0x047627ab
0x047627b9
0x047627b9
0x047627be
0x047627c1
0x047627c3
0x047627c5
0x047627c7
0x047a5c74
0x047a5c79
0x047a5c79
0x047627c7
0x00000000
0x047626c0
0x047626c0
0x047626c3
0x047626c6
0x047626c6
0x047626c9
0x047626c9
0x00000000
0x047626c9
0x047626ba
0x0476265b
0x0476265b
0x0476265e
0x04762667
0x0476266d
0x04762677
0x0476267c
0x0476267f
0x04762681
0x047a5b49
0x047a5b4e
0x047627cd
0x047627d0
0x047627d1
0x047627d2
0x047627d4
0x047627dd
0x04762687
0x04762687
0x0476268a
0x0476268b
0x0476268e
0x0476268f
0x04762691
0x04762696
0x04762698
0x0476269d
0x0476269f
0x00000000
0x0476269f
0x04762681
0x00000000
0x00000000
0x04762846
0x00000000
0x00000000
0x04762605
0x0476260a
0x0476260c
0x04762611
0x04762616
0x04762619
0x04762619
0x0476261e
0x00000000
0x04762624
0x04762627
0x04762627
0x00000000
0x00000000
0x047a5b1f
0x00000000
0x00000000
0x04762894
0x0476289b
0x0476289d
0x047628a1
0x047a5b2b
0x047a5b2e
0x047a5b2e
0x047628a7
0x047628a9
0x047a5b04
0x047a5b09
0x047a5b09
0x047a5b09
0x00000000
0x00000000
0x047a5b35
0x047a5b3c
0x047628fb
0x047628fb
0x047626cc
0x047626cc
0x047626d0
0x00000000
0x047626d2
0x047626d2
0x00000000
0x047626d2
0x00000000
0x00000000
0x047625fe
0x0476292d
0x0476292d
0x04762930
0x04762935
0x04762937
0x04762939
0x04762939
0x0476293d
0x0476293f
0x04762945
0x04762946
0x04762946
0x04762946
0x04762946
0x04762949
0x04762949
0x0476294e
0x0476294f
0x04762951
0x04762951
0x04762951
0x04762952
0x04762952
0x04762952
0x04762952
0x04762955
0x0476295a
0x0476295d
0x04762960
0x04762960
0x04762962
0x04762963
0x04762965
0x04762966
0x04762966
0x04762966
0x04762966
0x04762969
0x0476296a
0x0476296a
0x0476296a
0x0476296e
0x0476296f
0x04762971
0x04762974
0x04762974
0x04762977
0x0476297d
0x0476297d
0x0476297e
0x0476297f
0x04762980
0x04762979
0x04762979
0x0476297b
0x00000000
0x00000000
0x0476297b
0x04762981
0x04762982
0x04762983
0x04762984
0x04762985
0x04762986
0x04762987
0x04762988
0x04762989
0x0476298a
0x0476298b
0x0476298c
0x0476298d
0x0476298e
0x0476298f
0x04762990
0x04762992
0x04762997
0x047629a3
0x047629a6
0x047629ab
0x047629ad
0x047629b0
0x047629b2
0x047a5c80
0x047629b8
0x047629b8
0x047629bb
0x047629c0
0x047629c5
0x047629c6
0x047629c6
0x047629c9
0x047629cb
0x00000000
0x00000000
0x047629cd
0x047629d0
0x047629d9
0x047629db
0x047629dd
0x04762a7f
0x04762a84
0x04762a87
0x04762a89
0x047a5ca1
0x047a5ca3
0x00000000
0x04762a8f
0x04762a8f
0x00000000
0x04762a8f
0x00000000
0x047629e3
0x047629e3
0x047629e3
0x00000000
0x047629e3
0x047629dd
0x00000000
0x047629db
0x047629e6
0x047629e9
0x047629eb
0x047629ed
0x047629f3
0x047629f5
0x047629f8
0x047629fa
0x04762a97
0x04762a9a
0x04762a9d
0x04762add
0x00000000
0x04762a9f
0x04762aa2
0x04762aa5
0x04762aa8
0x04762aab
0x047a5cab
0x047a5caf
0x047a5cc5
0x047a5cda
0x047a5cdc
0x047a5cdf
0x047a5ce5
0x00000000
0x047a5ceb
0x047a5ced
0x047a5cee
0x00000000
0x047a5cee
0x047a5cb1
0x047a5cb4
0x047a5cb9
0x047a5cbb
0x00000000
0x047a5cbd
0x047a5cbd
0x00000000
0x047a5cbd
0x047a5cbb
0x04762ab1
0x04762ab1
0x04762ac4
0x04762ac6
0x04762ac6
0x00000000
0x04762ac6
0x04762aab
0x00000000
0x04762a00
0x04762a09
0x04762a0e
0x04762a21
0x04762a24
0x04762a35
0x04762a3a
0x04762a3d
0x04762a42
0x04762a59
0x04762a59
0x04762a5c
0x04762a5f
0x04762a5f
0x047629fa
0x047629f3
0x04762a64
0x04762a64
0x04762a6b
0x04762a6b
0x04762a6d
0x04762a72
0x04762a72
0x00000000

Strings

PATH, xrefs: 04762642, 04762691

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: d007a82bff46768be55cd4f41e6be9775d87609533395a6e3c99c8718219dccd
Instruction ID: dfb37f37e65fba3093ab25491c89b72bb88eed16f59c16c4fde21d8006211432
Opcode Fuzzy Hash: d007a82bff46768be55cd4f41e6be9775d87609533395a6e3c99c8718219dccd
Instruction Fuzzy Hash: 93C1B071E00219EBDB64EFA9D980BADB7B6FF48704F044569E902BB351E734B941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0476FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0476FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E0474EEF0(0x4827b60);
					_t134 =  *0x4827b84; // 0x776f7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0x4827b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x4827b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E04746D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E047476E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E047D8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E0473B150();
													}
													_t116 = E047D6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E047475CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0x4828638; // 0x80e160
																	_t122 = L047438A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E047476E2(_t154);
																			goto L41;
																		}
																	} else {
																		E047476E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L0476FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L047470F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E0476FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E0476FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E0476FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E0476FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E0476FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0x4827b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0x4827b84 = _t75;
						_t73 = E0474EB70(_t134, 0x4827b60);
						if( *0x4827b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E0474FF60( *0x4827b20);
							}
						}
						goto L5;
					}
				}
			}

0x0476fab0
0x0476fab2
0x0476fab3
0x0476fab4
0x0476fabc
0x0476fac0
0x0476fb14
0x0476fb17
0x0476fac2
0x0476fac8
0x0476facd
0x0476fad3
0x0476fad3
0x0476fadd
0x0476fb18
0x0476fb1b
0x0476fb1d
0x0476fb1e
0x0476fb1f
0x0476fb20
0x0476fb21
0x0476fb22
0x0476fb23
0x0476fb24
0x0476fb25
0x0476fb26
0x0476fb27
0x0476fb28
0x0476fb29
0x0476fb2a
0x0476fb2b
0x0476fb2c
0x0476fb2d
0x0476fb2e
0x0476fb2f
0x0476fb3a
0x0476fb3b
0x0476fb3e
0x0476fb41
0x0476fb44
0x0476fb47
0x0476fb4a
0x0476fb4d
0x0476fb53
0x047abdcb
0x047abdcb
0x0476fb59
0x0476fb5b
0x0476fb5b
0x0476fb5e
0x047abdd5
0x047abdd8
0x00000000
0x047abdda
0x00000000
0x047abdda
0x0476fb64
0x0476fb64
0x0476fb64
0x0476fb67
0x0476fb6e
0x0476fb70
0x0476fb72
0x00000000
0x0476fb78
0x0476fb7a
0x0476fb7a
0x0476fb7d
0x0476fb80
0x047abddf
0x047abde1
0x00000000
0x047abde3
0x00000000
0x047abde3
0x0476fb86
0x0476fb86
0x0476fb86
0x0476fb8b
0x0476fb90
0x0476fb92
0x0476fb94
0x0476fb9a
0x0476fb9b
0x0476fba1
0x047abde8
0x047abdeb
0x047abded
0x047abeb5
0x047abeb5
0x047abebb
0x047abebd
0x047abec3
0x047abed2
0x047abedd
0x047abedd
0x047abeed
0x00000000
0x047abdf3
0x047abdfe
0x047abe06
0x047abe0b
0x047abe0d
0x047abe0f
0x047abe14
0x047abe19
0x047abe20
0x047abe25
0x047abe27
0x047abe35
0x047abe39
0x047abe46
0x047abe4f
0x047abe54
0x047abe56
0x047abef8
0x047abef8
0x00000000
0x047abe5c
0x047abe5c
0x047abe60
0x00000000
0x047abe66
0x047abe66
0x047abe7f
0x047abe84
0x047abe87
0x047abe89
0x047abe8b
0x047abe99
0x047abe9d
0x047abea0
0x047abeac
0x047abeaf
0x047abeb1
0x047abeb3
0x047abeb3
0x00000000
0x047abea2
0x047abea2
0x00000000
0x047abea2
0x047abe8d
0x047abe8d
0x047abe92
0x00000000
0x047abe92
0x047abe8b
0x047abe60
0x047abe3b
0x047abe3b
0x047abe3e
0x00000000
0x047abe40
0x047abe40
0x047abe44
0x00000000
0x00000000
0x00000000
0x00000000
0x047abe44
0x047abe3e
0x047abe29
0x047abe29
0x00000000
0x047abe29
0x047abe27
0x00000000
0x0476fba7
0x0476fba7
0x0476fbab
0x047abf02
0x0476fbb1
0x0476fbb1
0x0476fbb8
0x0476fbbd
0x0476fbbd
0x0476fbbf
0x0476fbbf
0x0476fbc5
0x0476fbcb
0x0476fbf8
0x0476fbf8
0x0476fbfa
0x00000000
0x0476fc00
0x0476fc00
0x0476fc03
0x00000000
0x0476fc09
0x0476fc09
0x0476fc0f
0x0476fc15
0x0476fc23
0x0476fc23
0x0476fc25
0x0476fc27
0x0476fc75
0x0476fc7c
0x0476fc84
0x00000000
0x0476fc29
0x0476fc29
0x0476fc2d
0x0476fc30
0x047abf0f
0x00000000
0x0476fc36
0x0476fc38
0x0476fc3b
0x0476fc41
0x047abf17
0x047abf19
0x047abf48
0x047abf4b
0x00000000
0x047abf1b
0x047abf22
0x047abf24
0x047abf26
0x00000000
0x047abf2c
0x047abf37
0x047abf39
0x047abf3b
0x00000000
0x047abf41
0x047abf41
0x047abf41
0x047abf41
0x047abf45
0x00000000
0x047abf45
0x047abf3b
0x047abf26
0x00000000
0x0476fc47
0x0476fc47
0x0476fc49
0x0476fcb2
0x0476fcb4
0x0476fcb6
0x0476fcdc
0x0476fcdc
0x00000000
0x0476fcb8
0x0476fcc3
0x0476fcc5
0x0476fcc7
0x00000000
0x0476fcc9
0x0476fcc9
0x0476fccd
0x00000000
0x0476fccd
0x0476fcc7
0x00000000
0x0476fc4b
0x0476fc4b
0x0476fc4e
0x0476fc4e
0x0476fc51
0x0476fc51
0x0476fc54
0x0476fc5a
0x0476fc5c
0x0476fc5f
0x0476fc61
0x0476fc63
0x0476fc65
0x0476fc67
0x0476fc6e
0x0476fc72
0x0476fc72
0x0476fc72
0x0476fc72
0x0476fc67
0x0476fc61
0x00000000
0x0476fc5a
0x0476fc49
0x0476fc41
0x0476fc30
0x0476fc27
0x0476fc03
0x0476fbcd
0x0476fbd3
0x0476fbd9
0x0476fbdc
0x0476fbde
0x0476fc99
0x0476fc9b
0x0476fc9d
0x0476fcd5
0x0476fcd5
0x0476fc89
0x0476fc89
0x00000000
0x0476fc9f
0x0476fc9f
0x0476fca3
0x00000000
0x0476fca3
0x00000000
0x0476fbe4
0x0476fbe4
0x0476fbe4
0x0476fbe4
0x0476fbe9
0x0476fbf2
0x00000000
0x0476fbf2
0x0476fbde
0x0476fbcb
0x0476fbab
0x0476fc8b
0x0476fc8b
0x0476fc8c
0x0476fb80
0x0476fb72
0x0476fb5e
0x0476fc8d
0x0476fc91
0x0476fadf
0x0476fadf
0x0476fae1
0x0476fae4
0x0476fae7
0x0476faec
0x0476faf8
0x0476fb00
0x0476fb07
0x0476fb0f
0x0476fb0f
0x0476fb07
0x00000000
0x0476faf8
0x0476fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 047ABE0F

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!
API String ID: 0-865735534
Opcode ID: e7d2abfc05559b7e41882f68307ba0f337db1b26ef4cab4b9aebcb9959a35313
Instruction ID: c67f07dbaf55421286f5ac16207140472696659c6208d6c2ebc3bb25dd1daa59
Opcode Fuzzy Hash: e7d2abfc05559b7e41882f68307ba0f337db1b26ef4cab4b9aebcb9959a35313
Instruction Fuzzy Hash: CEA11331B006058BEB25DF79D454B7AB7A6AF84714F04466AED07DB780EB30F845CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04732D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E04732D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0x4825350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0x4827bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E047797C0();
				}
				if( *0x48279c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0x48279c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E04761624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E04757D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E047CFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E04779520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E0476E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L0478DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0x4826901;
								_push(_t109);
								_v52 = _t98;
								if( *0x4826901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E04779980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E047795D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E04757D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E04757D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E047B7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E047CFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0x4825350;
							if(_t109 != 0x4825350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E047CFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E047C5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x04732d8a
0x04732d8a
0x04732d92
0x04732d96
0x04732d9e
0x04732da0
0x04732da3
0x04732da5
0x04732da8
0x04732dab
0x04732db2
0x0478f9aa
0x0478f9ab
0x0478f9ae
0x0478f9ae
0x04732db8
0x04732dc2
0x0478f9b9
0x0478f9be
0x0478f9bf
0x0478f9bf
0x04732dcf
0x0478f9c9
0x04732dd5
0x04732dd5
0x04732dd5
0x04732dde
0x04732de1
0x04732e70
0x04732e72
0x04732e72
0x04732de7
0x04732deb
0x04732e7c
0x04732e83
0x04732e85
0x04732e8b
0x04732e8d
0x04732e92
0x04732e92
0x04732e85
0x04732df1
0x04732df7
0x04732df9
0x04732df9
0x04732dfc
0x04732dff
0x04732e02
0x00000000
0x04732e05
0x04732e0c
0x0478f9d9
0x04732e12
0x04732e12
0x04732e12
0x04732e1a
0x0478f9e3
0x0478f9e9
0x0478f9f0
0x0478f9f6
0x0478f9f8
0x0478f9f8
0x0478f9f0
0x04732e23
0x0478fa02
0x0478fa03
0x0478fa05
0x0478fa06
0x00000000
0x04732e29
0x04732e29
0x04732e2e
0x04732e34
0x04732e3e
0x00000000
0x00000000
0x04732e44
0x04732e47
0x04732e4d
0x00000000
0x00000000
0x04732e4f
0x04732e54
0x00000000
0x00000000
0x04732e5a
0x04732e5f
0x04732e9a
0x04732ea4
0x04732ea5
0x04732ea8
0x04732eaf
0x04732eb2
0x04732eb5
0x0478fae9
0x0478faeb
0x0478faed
0x0478faef
0x0478faf7
0x0478faf8
0x0478fafd
0x0478faff
0x0478fb04
0x0478fb04
0x0478faff
0x04732ec0
0x04732ec4
0x04732ec6
0x04732ec8
0x0478fb14
0x0478fb18
0x0478fb1e
0x0478fb21
0x0478fb21
0x04732ece
0x04732ece
0x04732ece
0x04732ed7
0x04732e61
0x04732e63
0x0478fa6b
0x0478fa71
0x0478fa76
0x0478fa78
0x0478fa8a
0x0478fa7a
0x0478fa83
0x0478fa83
0x0478fa8f
0x0478fa91
0x0478fa97
0x0478fa9d
0x0478faa4
0x0478faaa
0x0478faaf
0x0478fab1
0x0478fac3
0x0478fab3
0x0478fabc
0x0478fabc
0x0478fac8
0x0478facb
0x0478fadf
0x0478fadf
0x0478facb
0x0478faa4
0x0478fa91
0x04732e6f
0x04732e6f
0x04732e5f
0x0478fa13
0x0478fa15
0x0478fa17
0x0478fa1f
0x0478fa21
0x0478fa22
0x0478fa25
0x0478fa28
0x0478fa2f
0x0478fa2f
0x0478fa2a
0x0478fa2a
0x0478fa2a
0x0478fa31
0x0478fa34
0x0478fa36
0x0478fa3c
0x0478fa3e
0x0478fa41
0x0478fa43
0x0478fa45
0x0478fa45
0x0478fa41
0x0478fa3c
0x0478fa4a
0x0478fa4f
0x0478fa51
0x0478fa53
0x0478fa56
0x0478fa5b
0x0478fa5e
0x00000000
0x0478fa5e
0x04732e23

Strings

RTL: Re-Waiting, xrefs: 0478FA4A

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: 0eb9573bd6299716f8cd284631f098dfc55bafa4f742f90e0371b431eba19b90
Instruction ID: 3a45467e98f4668e2883d95df61a5a1fc9be1db4f9fcb0f039a923233bd8410b
Opcode Fuzzy Hash: 0eb9573bd6299716f8cd284631f098dfc55bafa4f742f90e0371b431eba19b90
Instruction Fuzzy Hash: CE613671B80604AFEB31EF78C848B7EB7A5EB45728F1406AED811973C2D774B9408792

Uniqueness

Uniqueness Score: -1.00%

Function 04800EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E04800EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E047FFF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E04801074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E04779730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E047FA80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E047FA854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0x4828b04 >> 0x14) + (_v44 -  *0x4828b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E04757D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E047F138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E04757D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E047EFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0x4828724 & 0x00000008) != 0) {
						E047F52F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E048015B5(0x4828ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x04800eb7
0x04800eb9
0x04800ec0
0x04800ec2
0x04800ecd
0x0480105b
0x0480105b
0x04801061
0x04801066
0x04801066
0x0480106b
0x04801073
0x04801073
0x04800ed3
0x04800ed6
0x04800edc
0x04800ee0
0x04800ee7
0x04800ef0
0x04800ef5
0x04800efa
0x04800efc
0x04800efd
0x04800f03
0x04800f04
0x04800f06
0x04800f07
0x04800f09
0x04800f0e
0x04800f14
0x04800f23
0x04800f2d
0x04800f34
0x04800f34
0x04800f14
0x04800f52
0x00000000
0x00000000
0x04800f58
0x04800f73
0x04800f74
0x04800f79
0x04800f7d
0x04800f80
0x04800f86
0x04800fab
0x04800fb5
0x04800fc6
0x04800fd1
0x04800fe3
0x04800fd3
0x04800fdc
0x04800fdc
0x04800feb
0x04801009
0x04801009
0x04801015
0x04801027
0x04801017
0x04801020
0x04801020
0x0480102f
0x0480103c
0x0480103c
0x04801048
0x04801050
0x04801050
0x04801055
0x00000000
0x04801055
0x04800f88
0x04800f9e
0x04800fa2
0x04800fa9
0x00000000
0x00000000
0x00000000
0x04800fa9
0x00000000

Strings

`, xrefs: 04800F16

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 7375cbcfeb50ae547f06f4370bf5b4d7b46101aeb8e68bcb8211778d2d1eca51
Instruction ID: b25cc0ca20236724d30d7402e2d6e2443e72f6dc312e0fbd07c7c602debd2457
Opcode Fuzzy Hash: 7375cbcfeb50ae547f06f4370bf5b4d7b46101aeb8e68bcb8211778d2d1eca51
Instruction Fuzzy Hash: 2C51A9712143819FE365EE28DC88B1BB7E5EB84318F048A2CF986C72D0D671F805C762

Uniqueness

Uniqueness Score: -1.00%

Function 0476F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E0476F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E04754120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E04779830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E04779990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E047795D0();
							goto L11;
						} else {
							_t18 = _t82 + 0x18; // 0x802d381a
							_t109 = L04754620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								_t29 =  &(_t103[2]); // 0x2000802d
								E0477F3E0(_t21,  *_t29,  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t34 =  &(_t103[2]); // 0x2000802d
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)( *_t34 + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E047795D0();
										L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x0476f0d3
0x0476f0d9
0x0476f0e0
0x0476f0e7
0x0476f0f2
0x0476f0f4
0x0476f0f8
0x0476f100
0x0476f108
0x0476f10d
0x0476f115
0x0476f116
0x0476f11f
0x0476f123
0x0476f124
0x0476f12c
0x0476f130
0x0476f134
0x0476f13d
0x0476f144
0x0476f14b
0x0476f152
0x047abab0
0x047abab0
0x0476f158
0x0476f158
0x0476f15a
0x0476f160
0x0476f165
0x0476f166
0x0476f16f
0x0476f173
0x047abaa7
0x047abaa7
0x047abaab
0x00000000
0x0476f179
0x0476f179
0x0476f18d
0x0476f191
0x047abaa2
0x00000000
0x0476f197
0x0476f19b
0x0476f1a2
0x0476f1a9
0x0476f1af
0x0476f1b2
0x0476f1b6
0x0476f1b9
0x0476f1c0
0x0476f1c4
0x0476f1d8
0x0476f1df
0x0476f1e3
0x0476f1e6
0x0476f1eb
0x0476f1ee
0x0476f1f4
0x0476f20f
0x047abab7
0x047ababb
0x047abacc
0x047abad1
0x0476f215
0x0476f218
0x0476f226
0x0476f22b
0x00000000
0x0476f22b
0x0476f1f6
0x0476f1f6
0x0476f1f9
0x0476f1fb
0x0476f1fb
0x0476f1f4
0x0476f191
0x0476f173
0x0476f152
0x0476f203

Strings

@, xrefs: 0476F124

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: e42f26938009dbd986eefa567b815710116474988cbc4e1bb8cd78117c9a1aa5
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: CA517B712057109FD320DF19C840A6BBBF9FF88714F008A29FA96977A0E7B4E954CB91

Uniqueness

Uniqueness Score: -1.00%

Function 047B3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E047B3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0x482d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E04770BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E047B3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E0477FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E047B3540;
						E0477FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E0478DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E047C0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E047797C0();
					}
					return E0477B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E047B3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E047B3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E0477FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E04779650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E047B3787(_a4,  &_v352, _t80);
						}
					}
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E047795D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x047b3552
0x047b355a
0x047b355d
0x047b3566
0x047b3567
0x047b357e
0x047b358f
0x047b35a1
0x047b35a5
0x047b366b
0x047b366b
0x047b366d
0x047b3672
0x047b3679
0x047b3685
0x047b368d
0x047b369d
0x047b36a7
0x047b36b8
0x047b36c6
0x047b36c7
0x047b36dc
0x047b36e1
0x047b36e7
0x047b36e9
0x047b36e9
0x047b3703
0x047b3703
0x047b35b5
0x047b35c0
0x047b35c4
0x00000000
0x00000000
0x047b35ca
0x047b35d7
0x047b35e2
0x047b35e6
0x047b35e8
0x047b35f5
0x047b35fa
0x047b3603
0x047b3604
0x047b3609
0x047b360a
0x047b3612
0x047b3613
0x047b361e
0x047b3622
0x047b3628
0x047b362f
0x047b362f
0x047b3636
0x047b3638
0x047b363b
0x047b3642
0x047b3642
0x047b3636
0x047b3657
0x047b3657
0x047b365c
0x047b3662
0x047b3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 047B358F

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: a2460b03c2ea1f251930733f962d94fedd8b852af259ba8d4e2d0791a9b7aee0
Instruction ID: a277a33c88171a2f6600ef50cc77665d6d6fe420934dbc62b6b25971f71340bb
Opcode Fuzzy Hash: a2460b03c2ea1f251930733f962d94fedd8b852af259ba8d4e2d0791a9b7aee0
Instruction Fuzzy Hash: 224103F190152C9AEF219A50CC84FDEB77CAB44718F5045A5EA49AB350DB30AE888FD5

Uniqueness

Uniqueness Score: -1.00%

Function 048005AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E048005AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E048007DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E04779730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E047FA80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E047FA854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E04801293(_t79, _v40, E048007DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E04757D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E047F138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x048005c5
0x048005ca
0x048005d3
0x048006db
0x048006db
0x048006dd
0x048006e3
0x048006e3
0x048005dd
0x048005e7
0x048005f6
0x04800600
0x04800607
0x04800610
0x04800615
0x0480061a
0x0480061c
0x0480061e
0x04800624
0x04800625
0x04800627
0x04800628
0x04800631
0x04800640
0x0480064d
0x04800654
0x04800654
0x04800631
0x0480066d
0x04800674
0x00000000
0x00000000
0x04800692
0x0480069e
0x048006b0
0x048006a0
0x048006a9
0x048006a9
0x048006b8
0x048006d6
0x048006d6
0x00000000

Strings

`, xrefs: 04800633

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: fefd6f21b291e31d937a717f18c372e5172743d853c09d5511d613e20b065a30
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: 2431F3326143496BE760DE24DC44F9777DAEB84758F048629FA59EB2C0D7B0F904C791

Uniqueness

Uniqueness Score: -1.00%

Function 047B3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E047B3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E04779650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L04754620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E04779650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x047b3893
0x047b3896
0x047b3899
0x047b389f
0x047b38a0
0x047b38a4
0x047b38a9
0x047b38ac
0x047b38ad
0x047b38ae
0x047b38af
0x047b38b1
0x047b38b4
0x047b38bb
0x047b38bc
0x047b38bd
0x047b38c4
0x047b38c8
0x047b38ca
0x047b38ca
0x047b38d5
0x047b393e
0x047b3940
0x047b3942
0x047b3952
0x047b3954
0x047b3961
0x047b3961
0x047b3967
0x047b396e
0x047b396e
0x047b3947
0x047b394c
0x00000000
0x047b394c
0x047b38ea
0x047b38ee
0x047b38f8
0x047b38f9
0x047b38ff
0x047b3900
0x047b3902
0x047b3903
0x047b390b
0x047b390f
0x047b3950
0x00000000
0x047b3950
0x047b3915
0x047b391d
0x047b391d
0x047b3922
0x047b3926
0x00000000
0x047b3928
0x047b392b
0x047b392b
0x047b3935
0x047b3937
0x047b3937
0x00000000
0x047b3935
0x047b3926
0x047b38f0
0x00000000

Strings

BinaryName, xrefs: 047B38B4

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: a6c2a81999958cbc3b1c2c74892f1800f113a50a4305a102c1fe83b846b8fc53
Instruction ID: 8bb0ddcfdf88b48aa0409807e2d77bd9739c0e5e35ab7f2ced6c6e7462e69408
Opcode Fuzzy Hash: a6c2a81999958cbc3b1c2c74892f1800f113a50a4305a102c1fe83b846b8fc53
Instruction Fuzzy Hash: 1F310572901609BFEB25DA59C945FABB774EB40B24F014129ED85A7750D730FE80C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 0476D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E0476D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0x482d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E04754120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E0477B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E047798D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E047795D0();
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x0476d29c
0x0476d2a6
0x0476d2b1
0x0476d2b5
0x0476d2b6
0x0476d2bc
0x0476d2bd
0x0476d2be
0x0476d2bf
0x0476d2c2
0x0476d2c4
0x0476d2cc
0x0476d384
0x0476d34b
0x0476d34f
0x0476d350
0x0476d351
0x0476d35c
0x0476d35c
0x0476d2d6
0x0476d2da
0x0476d2e1
0x0476d361
0x0476d369
0x0476d36d
0x0476d2e3
0x0476d2e3
0x0476d2e3
0x0476d2e5
0x0476d2ed
0x0476d2f5
0x0476d2fa
0x0476d302
0x0476d303
0x0476d30b
0x0476d30f
0x0476d313
0x0476d318
0x0476d31c
0x0476d320
0x0476d379
0x0476d37d
0x00000000
0x00000000
0x047aaffe
0x047ab001
0x047ab011
0x00000000
0x0476d322
0x0476d322
0x0476d330
0x0476d337
0x0476d35d
0x0476d339
0x0476d33f
0x0476d38c
0x0476d38c
0x0476d33f
0x0476d349
0x00000000
0x0476d349

Strings

@, xrefs: 0476D303

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: bf3494c0ff160d123bb9682ab35e8cac8d8a88cec1b74b22e87d7f9fd251c5be
Instruction ID: 310ea63c4c0b1a9f00f890b9e66af59fc440cf827d5ee3a492037fd29fbf6333
Opcode Fuzzy Hash: bf3494c0ff160d123bb9682ab35e8cac8d8a88cec1b74b22e87d7f9fd251c5be
Instruction Fuzzy Hash: 8831A4B1618305DFD720DF2EC98495BBBE9EB85754F00092EF99593310E638ED04DB92

Uniqueness

Uniqueness Score: -1.00%

Function 04741B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E04741B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E0477BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E0477A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E0477A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L04754620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x04741b8f
0x04741b9a
0x04741b9c
0x04741b9e
0x04741ba3
0x04797010
0x04797010
0x00000000
0x04741ba9
0x04741ba9
0x04741bae
0x00000000
0x04741bc5
0x04741bca
0x04741bcf
0x04741bd0
0x04741bd1
0x04741bd2
0x04741bd6
0x04741bdc
0x04741be0
0x04796ffc
0x04797000
0x00000000
0x04797006
0x04797009
0x04797009
0x04741be6
0x04741bec
0x04741c0b
0x04741c0b
0x04741c0c
0x04741c11
0x04741c12
0x04741c15
0x04741c1b
0x04741c1f
0x04741c31
0x04741c33
0x04797026
0x04797026
0x04741c21
0x04741c24
0x04741c24
0x04741bee
0x04741bee
0x04741bf2
0x04741c3a
0x04741bf4
0x04741bf4
0x04741c05
0x04741c05
0x04741c09
0x04741c3e
0x00000000
0x00000000
0x00000000
0x04741c09
0x04741bec
0x04741be0
0x04741bae
0x04741c2e

Strings

WindowsExcludedProcs, xrefs: 04741BC5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: b3f925bf3ed49fd9f916e5b18caad834b5225c5d05ebe5ee2f9c0a85b04b29bb
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 5221D336A00228FBDF21EE999C48F6BB7ADEB81750F454465AD048B300E730FD5497A0

Uniqueness

Uniqueness Score: -1.00%

Function 0475F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0475F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x0475f71d
0x0475f722
0x0475f726
0x047a4770
0x0475f765
0x0475f769
0x0475f769
0x0475f732
0x047a477a
0x00000000
0x047a477a
0x0475f738
0x0475f73a
0x0475f73c
0x0475f73f
0x0475f746
0x0475f778
0x0475f7a9
0x0475f7a9
0x0475f754
0x0475f75a
0x0475f75d
0x0475f75f
0x0475f761
0x0475f76f
0x0475f771
0x0475f771
0x0475f76f
0x0475f763
0x00000000
0x0475f763
0x0475f77d
0x0475f7a3
0x0475f7a5
0x00000000
0x0475f7a5
0x0475f77f
0x0475f782
0x0475f784
0x0475f786
0x00000000
0x00000000
0x00000000
0x0475f788
0x0475f748
0x0475f74d
0x0475f78d
0x0475f793
0x0475f7b7
0x0475f7bc
0x00000000
0x0475f7bc
0x0475f798
0x00000000
0x00000000
0x0475f79d
0x0475f7b0
0x00000000
0x0475f7b0
0x0475f79f
0x00000000
0x0475f74f
0x0475f74f
0x00000000
0x0475f74f

Strings

Actx , xrefs: 0475F73F

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: d0221b8e05ca15dc4cb148ed3b15923343911dd6b299771459a650aedb3f92fb
Instruction ID: 1d66b9bc37b273f5bcdaeadca44b9879f8281efc96eb99484036c834d47da50e
Opcode Fuzzy Hash: d0221b8e05ca15dc4cb148ed3b15923343911dd6b299771459a650aedb3f92fb
Instruction Fuzzy Hash: 441190353456428BEB244E1E8490736729EEB95724FA44D2AEC62CF3B1EBF0F8408740

Uniqueness

Uniqueness Score: -1.00%

Function 047E8DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E047E8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0x4810d50);
				E0478D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E047C5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L0478DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L0478DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E0478D130(_t34, _t39, _t40);
			}

0x047e8df1
0x047e8df1
0x047e8df1
0x047e8df1
0x047e8df1
0x047e8df1
0x047e8df3
0x047e8df8
0x047e8dfd
0x047e8e00
0x047e8e0e
0x047e8e2a
0x047e8e36
0x047e8e38
0x047e8e3c
0x047e8e46
0x047e8e46
0x047e8e36
0x047e8e50
0x047e8e56
0x047e8e59
0x047e8e5c
0x047e8e60
0x047e8e67
0x047e8e6d
0x047e8e73
0x047e8e74
0x047e8eb1
0x047e8ebd

Strings

Critical error detected %lx, xrefs: 047E8E21

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 26fb30577439aae559c9b756917419c97e2a3362bf20748d51ef1cb6f43a48a2
Instruction ID: d88a5a6e0accc061e47599a8f8116756e9b90a2ed9e157f1cbbd427e0ea77654
Opcode Fuzzy Hash: 26fb30577439aae559c9b756917419c97e2a3362bf20748d51ef1cb6f43a48a2
Instruction Fuzzy Hash: 81117971D40348EBEB25EFB58909BECBBB0AB08314F24425ED029AB381C3342601CF15

Uniqueness

Uniqueness Score: -1.00%

Function 047CFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 047CFF60

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 7781a9d93e34121c92512211b320db4804af9da92b859f33916f1fc62e5f8ce1
Instruction ID: c01a3ad88f31134c9f6dd896331634aae832df6bac819f59c70bdb6a8b168192
Opcode Fuzzy Hash: 7781a9d93e34121c92512211b320db4804af9da92b859f33916f1fc62e5f8ce1
Instruction Fuzzy Hash: B211ED71990144EFEB22EF50C948F98BBB2FF08718F55844CE508AB3A1C779B980DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0473F900, Relevance: .9, Instructions: 863
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E0473F900(signed int _a4, signed int _a8) {
				signed char _v5;
				signed char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed char _t285;
				signed int _t289;
				signed char _t292;
				signed int _t293;
				signed char _t295;
				signed int _t300;
				signed int _t301;
				signed char _t306;
				signed char _t307;
				signed char _t308;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed char _t314;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t328;
				signed char _t329;
				signed int _t337;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				signed int _t348;
				signed char _t350;
				signed int _t351;
				signed char _t353;
				signed char _t356;
				signed int _t357;
				signed char _t359;
				signed int _t360;
				signed char _t363;
				signed int _t364;
				signed int _t366;
				signed int* _t372;
				signed char _t373;
				signed char _t378;
				signed int _t379;
				signed int* _t382;
				signed int _t383;
				signed char _t385;
				signed int _t387;
				signed int _t388;
				signed char _t390;
				signed int _t393;
				signed int _t395;
				signed char _t397;
				signed int _t401;
				signed int _t405;
				signed int _t407;
				signed int _t409;
				signed int _t410;
				signed int _t413;
				signed char _t415;
				signed int _t416;
				signed char _t418;
				signed int _t419;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed char* _t425;
				signed char _t426;
				signed char _t427;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t462;
				signed int _t464;
				signed int _t467;
				signed int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t477;
				signed int _t481;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;

				_t285 =  *(_a4 + 4);
				_t444 = _a8;
				_t452 =  *_t444;
				_t421 = _t285 & 1;
				if(_t421 != 0) {
					if(_t452 != 0) {
						_t452 = _t452 ^ _t444;
					}
				}
				_t393 =  *(_t444 + 4);
				if(_t421 != 0) {
					if(_t393 != 0) {
						_t393 = _t393 ^ _t444;
					}
				}
				_t426 = _t393;
				if(_t452 != 0) {
					_t426 = _t452;
				}
				_v5 = _t285 & 0x00000001;
				asm("sbb eax, eax");
				if((_t393 &  ~_t452) != 0) {
					_t289 = _t393;
					_t427 = _v5;
					_t422 = _t393;
					_v12 = _t393;
					_v16 = 1;
					if( *_t393 != 0) {
						_v16 = _v16 & 0x00000000;
						_t445 =  *_t393;
						goto L115;
						L116:
						_t289 = _t445;
						L117:
						_t445 =  *_t289;
						if(_t445 != 0) {
							L115:
							_t422 = _t289;
							if(_t427 != 0) {
								goto L183;
							}
							goto L116;
						} else {
							_t444 = _a8;
							_v12 = _t289;
							goto L27;
						}
						L183:
						if(_t445 == 0) {
							goto L116;
						}
						_t289 = _t289 ^ _t445;
						goto L117;
					}
					L27:
					if(_t427 != 0) {
						if(_t452 == 0) {
							goto L28;
						}
						_t428 = _t289 ^ _t452;
						L29:
						 *_t289 = _t428;
						_t429 =  *(_t452 + 8);
						_v20 = _t429;
						_t426 = _t429 & 0xfffffffc;
						_t292 =  *(_a4 + 4) & 0x00000001;
						_v6 = _t292;
						_t293 = _v12;
						if(_t292 != 0) {
							if(_t426 != 0) {
								_t426 = _t426 ^ _t452;
							}
						}
						if(_t426 != _t444) {
							L174:
							_t423 = 0x1d;
							asm("int 0x29");
							goto L175;
						} else {
							_t436 = _t293;
							if(_v6 != 0) {
								_t436 = _t436 ^ _t452;
							}
							_v20 = _v20 & 0x00000003;
							_v20 = _v20 | _t436;
							 *(_t452 + 8) = _v20;
							_t426 =  *(_t393 + 8) & 0xfffffffc;
							_t356 =  *(_a4 + 4) & 0x00000001;
							_v6 = _t356;
							_t357 = _v12;
							if(_t356 != 0) {
								if(_t426 != 0) {
									_t426 = _t426 ^ _t393;
								}
							}
							if(_t426 != _t444) {
								goto L174;
							} else {
								_t483 = _t393 ^ _t357;
								_v24 = _t483;
								if(_v6 == 0) {
									_v24 = _t357;
								}
								 *(_t393 + 8) =  *(_t393 + 8) & 0x00000003 | _v24;
								_t426 =  *(_t357 + 4);
								_t444 = _a8;
								_t359 =  *(_a4 + 4) & 0x00000001;
								_v6 = _t359;
								_t360 = _v12;
								_v24 = _t483;
								if(_t359 != 0) {
									_v24 = _t483;
									if(_t426 == 0) {
										goto L37;
									}
									_t426 = _t426 ^ _t360;
									L38:
									if(_v6 == 0) {
										_t483 = _t393;
									}
									_t413 =  *(_t360 + 8);
									 *(_t360 + 4) = _t483;
									_t452 = _t413 & 0xfffffffc;
									_v5 = _t413;
									_t363 =  *(_a4 + 4) & 0x00000001;
									_v6 = _t363;
									if(_t363 != 0) {
										_t364 = _v12;
										_v5 = _t413;
										if(_t452 == 0) {
											goto L41;
										}
										_v20 = _t452;
										_v20 = _v20 ^ _t364;
										L42:
										if(_v20 != _t422) {
											_v5 = _t413;
											if(_v6 == 0) {
												L199:
												_t366 = _v12;
												L200:
												if(_t452 != 0 || _t366 != _t422) {
													goto L174;
												} else {
													goto L43;
												}
											}
											_t366 = _v12;
											_v5 = _t413;
											if(_t452 == 0) {
												goto L199;
											}
											_t452 = _t452 ^ _t366;
											goto L200;
										}
										L43:
										_t486 =  *(_t444 + 8) & 0xfffffffc;
										if(_v6 != 0) {
											if(_t486 != 0) {
												_t486 = _t486 ^ _t444;
											}
											if(_v6 != 0 && _t486 != 0) {
												_t486 = _t486 ^ _t366;
											}
										}
										_t415 = _t413 & 0x00000003 | _t486;
										 *(_t366 + 8) = _t415;
										_t416 = _v12;
										 *(_t416 + 8) = ( *(_t444 + 8) ^ _t415) & 0x00000001 ^ _t415;
										_t452 =  *(_t444 + 8);
										_t372 = _a4;
										if((_t452 & 0xfffffffc) == 0) {
											if( *_t372 != _t444) {
												goto L174;
											} else {
												 *_t372 = _t416;
												goto L52;
											}
										} else {
											_t452 = _t452 & 0xfffffffc;
											_t378 = _t372[1] & 0x00000001;
											_v6 = _t378;
											if(_t378 != 0) {
												if(_t452 != 0) {
													_t452 = _t452 ^ _t444;
												}
											}
											_t379 =  *(_t452 + 4);
											if(_v6 != 0) {
												if(_t379 != 0) {
													_t379 = _t379 ^ _t452;
												}
											}
											_v24 = _t379;
											_t382 = _t452 + (0 | _v24 == _t444) * 4;
											_v28 = _t382;
											_t383 =  *_t382;
											if(_v6 != 0) {
												if(_t383 != 0) {
													_t383 = _t383 ^ _t452;
												}
											}
											if(_t383 != _t444) {
												goto L174;
											} else {
												if(_v6 != 0) {
													_t487 = _t452 ^ _t416;
												} else {
													_t487 = _t416;
												}
												 *_v28 = _t487;
												L52:
												_t373 = _v5;
												L12:
												_t452 = _a4;
												_v5 = _t373 & 0x00000001;
												if(( *(_t452 + 4) & 0x00000001) != 0) {
													if(_t426 == 0) {
														goto L13;
													}
													_t306 = _t422 ^ _t426;
													L14:
													_t444 = _v16;
													 *(_t422 + _t444 * 4) = _t306;
													if(_t426 != 0) {
														_t306 =  *(_t426 + 8) & 0xfffffffc;
														_t418 =  *(_t452 + 4) & 0x00000001;
														_v6 = _t418;
														_t419 = _v12;
														if(_t418 != 0) {
															if(_t306 != 0) {
																_t306 = _t306 ^ _t426;
															}
														}
														if(_t306 != _t419) {
															goto L174;
														} else {
															if(_v6 != 0) {
																if(_t422 != 0) {
																	_t422 = _t422 ^ _t426;
																}
															}
															 *(_t426 + 8) = _t422;
															L24:
															return _t306;
														}
													}
													if(_v5 != _t426) {
														goto L24;
													} else {
														_t395 = _t452;
														_t306 =  *(_t395 + 4);
														L17:
														_t446 = _t423;
														_t434 = _v16 ^ 0x00000001;
														_v24 = _t446;
														_v12 = _t434;
														_t452 =  *(_t423 + _t434 * 4);
														if((_t306 & 0x00000001) != 0) {
															if(_t452 == 0) {
																goto L18;
															}
															_t426 = _t452 ^ _t446;
															L19:
															if(( *(_t426 + 8) & 0x00000001) != 0) {
																_t310 =  *(_t426 + 8) & 0xfffffffc;
																_t444 = _t306 & 1;
																if(_t444 != 0) {
																	if(_t310 != 0) {
																		_t310 = _t310 ^ _t426;
																	}
																}
																if(_t310 != _t423) {
																	goto L174;
																} else {
																	if(_t444 != 0) {
																		if(_t452 != 0) {
																			_t452 = _t452 ^ _t423;
																		}
																	}
																	if(_t452 != _t426) {
																		goto L174;
																	} else {
																		_t452 =  *(_t423 + 8) & 0xfffffffc;
																		if(_t444 != 0) {
																			if(_t452 == 0) {
																				L170:
																				if( *_t395 != _t423) {
																					goto L174;
																				} else {
																					 *_t395 = _t426;
																					L140:
																					if(_t444 != 0) {
																						if(_t452 != 0) {
																							_t452 = _t452 ^ _t426;
																						}
																					}
																					 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																					_t300 =  *(_t426 + _v16 * 4);
																					if(_t444 != 0) {
																						if(_t300 == 0) {
																							goto L143;
																						}
																						_t300 = _t300 ^ _t426;
																						goto L142;
																					} else {
																						L142:
																						if(_t300 != 0) {
																							_t401 =  *(_t300 + 8);
																							_t452 = _t401 & 0xfffffffc;
																							if(_t444 != 0) {
																								if(_t452 != 0) {
																									_t452 = _t452 ^ _t300;
																								}
																							}
																							if(_t452 != _t426) {
																								goto L174;
																							} else {
																								if(_t444 != 0) {
																									_t481 = _t300 ^ _t423;
																								} else {
																									_t481 = _t423;
																								}
																								 *(_t300 + 8) = _t401 & 0x00000003 | _t481;
																								goto L143;
																							}
																						}
																						L143:
																						if(_t444 != 0) {
																							if(_t300 != 0) {
																								_t300 = _t300 ^ _t423;
																							}
																						}
																						 *(_t423 + _v12 * 4) = _t300;
																						_t454 = _t426;
																						if(_t444 != 0) {
																							_t455 = _t454 ^ _t423;
																							_t301 = _t455;
																						} else {
																							_t301 = _t423;
																							_t455 = _t454 ^ _t301;
																						}
																						 *(_t426 + _v16 * 4) = _t301;
																						_t395 = _a4;
																						if(_t444 == 0) {
																							_t455 = _t426;
																						}
																						 *(_t423 + 8) =  *(_t423 + 8) & 0x00000003 | _t455;
																						 *(_t426 + 8) =  *(_t426 + 8) & 0x000000fe;
																						 *(_t423 + 8) =  *(_t423 + 8) | 0x00000001;
																						_t426 =  *(_t423 + _v12 * 4);
																						_t306 =  *(_t395 + 4);
																						if((_t306 & 0x00000001) != 0) {
																							if(_t426 != 0) {
																								_t426 = _t426 ^ _t423;
																							}
																						}
																						_t446 = _v24;
																						goto L20;
																					}
																				}
																			}
																			_t452 = _t452 ^ _t423;
																		}
																		if(_t452 == 0) {
																			goto L170;
																		}
																		_t311 =  *(_t452 + 4);
																		if(_t444 != 0) {
																			if(_t311 != 0) {
																				_t311 = _t311 ^ _t452;
																			}
																		}
																		if(_t311 == _t423) {
																			if(_t444 != 0) {
																				L175:
																				_t295 = _t452 ^ _t426;
																				goto L169;
																			} else {
																				_t295 = _t426;
																				L169:
																				 *(_t452 + 4) = _t295;
																				goto L140;
																			}
																		} else {
																			_t312 =  *_t452;
																			if(_t444 != 0) {
																				if(_t312 != 0) {
																					_t312 = _t312 ^ _t452;
																				}
																			}
																			if(_t312 != _t423) {
																				goto L174;
																			} else {
																				if(_t444 != 0) {
																					_t314 = _t452 ^ _t426;
																				} else {
																					_t314 = _t426;
																				}
																				 *_t452 = _t314;
																				goto L140;
																			}
																		}
																	}
																}
															}
															L20:
															_t456 =  *_t426;
															_t307 = _t306 & 0x00000001;
															if(_t456 != 0) {
																if(_t307 != 0) {
																	_t456 = _t456 ^ _t426;
																}
																if(( *(_t456 + 8) & 0x00000001) == 0) {
																	goto L21;
																} else {
																	L56:
																	_t461 =  *(_t426 + _v12 * 4);
																	if(_t307 != 0) {
																		if(_t461 == 0) {
																			L59:
																			_t462 = _v16;
																			_t444 =  *(_t426 + _t462 * 4);
																			if(_t307 != 0) {
																				if(_t444 != 0) {
																					_t444 = _t444 ^ _t426;
																				}
																			}
																			 *(_t444 + 8) =  *(_t444 + 8) & 0x000000fe;
																			_t452 = _t462 ^ 0x00000001;
																			_t405 =  *(_t395 + 4) & 1;
																			_t316 =  *(_t444 + 8) & 0xfffffffc;
																			_v28 = _t405;
																			_v24 = _t452;
																			if(_t405 != 0) {
																				if(_t316 != 0) {
																					_t316 = _t316 ^ _t444;
																				}
																			}
																			if(_t316 != _t426) {
																				goto L174;
																			} else {
																				_t318 = _t452 ^ 0x00000001;
																				_v32 = _t318;
																				_t319 =  *(_t426 + _t318 * 4);
																				if(_t405 != 0) {
																					if(_t319 != 0) {
																						_t319 = _t319 ^ _t426;
																					}
																				}
																				if(_t319 != _t444) {
																					goto L174;
																				} else {
																					_t320 =  *(_t423 + _t452 * 4);
																					if(_t405 != 0) {
																						if(_t320 != 0) {
																							_t320 = _t320 ^ _t423;
																						}
																					}
																					if(_t320 != _t426) {
																						goto L174;
																					} else {
																						_t322 =  *(_t426 + 8) & 0xfffffffc;
																						if(_t405 != 0) {
																							if(_t322 != 0) {
																								_t322 = _t322 ^ _t426;
																							}
																						}
																						if(_t322 != _t423) {
																							goto L174;
																						} else {
																							_t464 = _t423 ^ _t444;
																							_t323 = _t464;
																							if(_t405 == 0) {
																								_t323 = _t444;
																							}
																							 *(_t423 + _v24 * 4) = _t323;
																							_t407 = _v28;
																							if(_t407 != 0) {
																								if(_t423 != 0) {
																									L72:
																									 *(_t444 + 8) =  *(_t444 + 8) & 0x00000003 | _t464;
																									_t328 =  *(_t444 + _v24 * 4);
																									if(_t407 != 0) {
																										if(_t328 == 0) {
																											L74:
																											if(_t407 != 0) {
																												if(_t328 != 0) {
																													_t328 = _t328 ^ _t426;
																												}
																											}
																											 *(_t426 + _v32 * 4) = _t328;
																											_t467 = _t426 ^ _t444;
																											_t329 = _t467;
																											if(_t407 == 0) {
																												_t329 = _t426;
																											}
																											 *(_t444 + _v24 * 4) = _t329;
																											if(_v28 == 0) {
																												_t467 = _t444;
																											}
																											_t395 = _a4;
																											_t452 = _t426;
																											 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t467;
																											_t426 = _t444;
																											L80:
																											 *(_t426 + 8) =  *(_t426 + 8) ^ ( *(_t426 + 8) ^  *(_t423 + 8)) & 0x00000001;
																											 *(_t423 + 8) =  *(_t423 + 8) & 0x000000fe;
																											 *(_t452 + 8) =  *(_t452 + 8) & 0x000000fe;
																											_t337 =  *(_t426 + 8) & 0xfffffffc;
																											_t444 =  *(_t395 + 4) & 1;
																											if(_t444 != 0) {
																												if(_t337 != 0) {
																													_t337 = _t337 ^ _t426;
																												}
																											}
																											if(_t337 != _t423) {
																												goto L174;
																											} else {
																												_t339 =  *(_t423 + _v12 * 4);
																												if(_t444 != 0) {
																													if(_t339 != 0) {
																														_t339 = _t339 ^ _t423;
																													}
																												}
																												if(_t339 != _t426) {
																													goto L174;
																												} else {
																													_t452 =  *(_t423 + 8) & 0xfffffffc;
																													if(_t444 != 0) {
																														if(_t452 == 0) {
																															L160:
																															if( *_t395 != _t423) {
																																goto L174;
																															} else {
																																 *_t395 = _t426;
																																L93:
																																if(_t444 != 0) {
																																	if(_t452 != 0) {
																																		_t452 = _t452 ^ _t426;
																																	}
																																}
																																_t409 = _v16;
																																 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																																_t343 =  *(_t426 + _t409 * 4);
																																if(_t444 != 0) {
																																	if(_t343 == 0) {
																																		goto L96;
																																	}
																																	_t343 = _t343 ^ _t426;
																																	goto L95;
																																} else {
																																	L95:
																																	if(_t343 != 0) {
																																		_t410 =  *(_t343 + 8);
																																		_t452 = _t410 & 0xfffffffc;
																																		if(_t444 != 0) {
																																			if(_t452 != 0) {
																																				_t452 = _t452 ^ _t343;
																																			}
																																		}
																																		if(_t452 != _t426) {
																																			goto L174;
																																		} else {
																																			if(_t444 != 0) {
																																				_t474 = _t343 ^ _t423;
																																			} else {
																																				_t474 = _t423;
																																			}
																																			 *(_t343 + 8) = _t410 & 0x00000003 | _t474;
																																			_t409 = _v16;
																																			goto L96;
																																		}
																																	}
																																	L96:
																																	if(_t444 != 0) {
																																		if(_t343 != 0) {
																																			_t343 = _t343 ^ _t423;
																																		}
																																	}
																																	 *(_t423 + _v12 * 4) = _t343;
																																	if(_t444 != 0) {
																																		_t345 = _t426 ^ _t423;
																																		_t470 = _t345;
																																	} else {
																																		_t345 = _t423;
																																		_t470 = _t426 ^ _t345;
																																	}
																																	 *(_t426 + _t409 * 4) = _t345;
																																	if(_t444 == 0) {
																																		_t470 = _t426;
																																	}
																																	_t306 =  *(_t423 + 8) & 0x00000003 | _t470;
																																	 *(_t423 + 8) = _t306;
																																	goto L24;
																																}
																															}
																														}
																														_t452 = _t452 ^ _t423;
																													}
																													if(_t452 == 0) {
																														goto L160;
																													}
																													_t348 =  *(_t452 + 4);
																													if(_t444 != 0) {
																														if(_t348 != 0) {
																															_t348 = _t348 ^ _t452;
																														}
																													}
																													if(_t348 == _t423) {
																														if(_t444 != 0) {
																															_t350 = _t452 ^ _t426;
																														} else {
																															_t350 = _t426;
																														}
																														 *(_t452 + 4) = _t350;
																														goto L93;
																													} else {
																														_t351 =  *_t452;
																														if(_t444 != 0) {
																															if(_t351 != 0) {
																																_t351 = _t351 ^ _t452;
																															}
																														}
																														if(_t351 != _t423) {
																															goto L174;
																														} else {
																															if(_t444 != 0) {
																																_t353 = _t452 ^ _t426;
																															} else {
																																_t353 = _t426;
																															}
																															 *_t452 = _t353;
																															goto L93;
																														}
																													}
																												}
																											}
																										}
																										_t328 = _t328 ^ _t444;
																									}
																									if(_t328 != 0) {
																										_t475 =  *(_t328 + 8);
																										_v20 = _t475;
																										_t452 = _t475 & 0xfffffffc;
																										if(_t407 != 0) {
																											if(_t452 != 0) {
																												_t452 = _t452 ^ _t328;
																											}
																										}
																										if(_t452 != _t444) {
																											goto L174;
																										} else {
																											if(_t407 != 0) {
																												_t477 = _t328 ^ _t426;
																											} else {
																												_t477 = _t426;
																											}
																											_v20 = _v20 & 0x00000003;
																											_v20 = _v20 | _t477;
																											 *(_t328 + 8) = _v20;
																											goto L74;
																										}
																									}
																									goto L74;
																								}
																							}
																							_t464 = _t423;
																							goto L72;
																						}
																					}
																				}
																			}
																		}
																		_t452 = _t461 ^ _t426;
																	}
																	if(_t452 == 0 || ( *(_t452 + 8) & 0x00000001) == 0) {
																		goto L59;
																	} else {
																		goto L80;
																	}
																}
															}
															L21:
															_t457 =  *(_t426 + 4);
															if(_t457 != 0) {
																if(_t307 != 0) {
																	_t457 = _t457 ^ _t426;
																}
																if(( *(_t457 + 8) & 0x00000001) == 0) {
																	goto L22;
																} else {
																	goto L56;
																}
															}
															L22:
															_t308 =  *(_t423 + 8);
															if((_t308 & 0x00000001) == 0) {
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																_t306 =  *(_t395 + 4);
																_t431 =  *(_t423 + 8) & 0xfffffffc;
																_t397 = _t306 & 0x00000001;
																if(_t397 != 0) {
																	if(_t431 == 0) {
																		goto L110;
																	}
																	_t423 = _t423 ^ _t431;
																	L111:
																	if(_t423 == 0) {
																		goto L24;
																	}
																	_t432 =  *(_t423 + 4);
																	if(_t397 != 0) {
																		if(_t432 != 0) {
																			_t432 = _t432 ^ _t423;
																		}
																	}
																	_v16 = 0 | _t432 == _t446;
																	_t395 = _a4;
																	goto L17;
																}
																L110:
																_t423 = _t431;
																goto L111;
															} else {
																_t306 = _t308 & 0x000000fe;
																 *(_t423 + 8) = _t306;
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																goto L24;
															}
														}
														L18:
														_t426 = _t452;
														goto L19;
													}
												}
												L13:
												_t306 = _t426;
												goto L14;
											}
										}
									}
									L41:
									_t366 = _v12;
									_v20 = _t452;
									goto L42;
								}
								L37:
								_t483 = _v24;
								goto L38;
							}
						}
					}
					L28:
					_t428 = _t452;
					goto L29;
				}
				_t385 = _v5;
				_t422 =  *(_t444 + 8) & 0xfffffffc;
				if(_t385 != 0) {
					if(_t422 != 0) {
						_t422 = _t422 ^ _t444;
					}
				}
				_v12 = _t444;
				if(_t422 == 0) {
					if(_t426 != 0) {
						 *(_t426 + 8) =  *(_t426 + 8) & 0x00000000;
					}
					_t425 = _a4;
					if( *_t425 != _t444) {
						goto L174;
					} else {
						_t425[4] = _t426;
						_t306 = _t425[4] & 0x00000001;
						if(_t306 != 0) {
							_t425[4] = _t425[4] | 0x00000001;
						}
						 *_t425 = _t426;
						goto L24;
					}
				} else {
					_t452 =  *(_t422 + 4);
					if(_t385 != 0) {
						if(_t452 != 0) {
							_t452 = _t452 ^ _t422;
						}
					}
					if(_t452 == _t444) {
						_v16 = 1;
						L11:
						_t373 =  *(_t444 + 8);
						goto L12;
					} else {
						_t387 =  *_t422;
						if(_v5 != 0) {
							if(_t387 != 0) {
								_t387 = _t387 ^ _t422;
							}
						}
						if(_t387 != _t444) {
							goto L174;
						} else {
							_t488 = _a4;
							_v16 = _v16 & 0x00000000;
							_t388 =  *(_t488 + 4);
							_v24 = _t388;
							if((_t388 & 0xfffffffe) == _t444) {
								if(_t426 != 0) {
									 *(_t488 + 4) = _t426;
									if((_v24 & 0x00000001) != 0) {
										_t390 = _t426;
										L228:
										 *(_t488 + 4) = _t390 | 0x00000001;
									}
									goto L11;
								}
								 *(_t488 + 4) = _t422;
								if((_v24 & 0x00000001) == 0) {
									goto L11;
								} else {
									_t390 = _t422;
									goto L228;
								}
							}
							goto L11;
						}
					}
				}
			}

0x0473f90b
0x0473f911
0x0473f917
0x0473f919
0x0473f91c
0x04795d63
0x04795d69
0x04795d69
0x04795d63
0x0473f922
0x0473f927
0x04795d72
0x04795d78
0x04795d78
0x04795d72
0x0473f92d
0x0473f931
0x0473fa2d
0x0473fa2d
0x0473f939
0x0473f940
0x0473f944
0x0473fa37
0x0473fa39
0x0473fa3c
0x0473fa3e
0x0473fa41
0x0473fa48
0x0473fe68
0x0473fe6c
0x0473fe6c
0x0473fe78
0x0473fe78
0x0473fe7a
0x0473fe7a
0x0473fe7e
0x0473fe6e
0x0473fe6e
0x0473fe72
0x00000000
0x00000000
0x00000000
0x0473fe80
0x0473fe80
0x0473fe83
0x00000000
0x0473fe83
0x04795d7f
0x04795d81
0x00000000
0x00000000
0x04795d87
0x00000000
0x04795d87
0x0473fa4e
0x0473fa50
0x04795d90
0x00000000
0x00000000
0x04795d98
0x0473fa58
0x0473fa58
0x0473fa5d
0x0473fa60
0x0473fa63
0x0473fa69
0x0473fa6b
0x0473fa6e
0x0473fa71
0x04795da1
0x04795da7
0x04795da7
0x04795da1
0x0473fa79
0x04740071
0x04740073
0x04740074
0x00000000
0x0473fa7f
0x0473fa83
0x0473fa85
0x04795dae
0x04795dae
0x0473fa8b
0x0473fa8f
0x0473fa98
0x0473faa1
0x0473faa4
0x0473faa6
0x0473faa9
0x0473faac
0x04795db7
0x04795dbd
0x04795dbd
0x04795db7
0x0473fab4
0x00000000
0x0473faba
0x0473fabc
0x0473fac2
0x0473fac5
0x0473fac7
0x0473fac7
0x0473fad6
0x0473fad9
0x0473fadf
0x0473fae2
0x0473fae4
0x0473fae7
0x0473faea
0x0473faed
0x04795dc4
0x04795dc9
0x00000000
0x00000000
0x04795dcf
0x0473faf6
0x0473fafa
0x0473fafc
0x0473fafc
0x0473fafe
0x0473fb01
0x0473fb09
0x0473fb0c
0x0473fb12
0x0473fb14
0x0473fb17
0x04795dd6
0x04795dd9
0x04795dde
0x00000000
0x00000000
0x04795de4
0x04795de7
0x0473fb29
0x0473fb2c
0x04795df3
0x04795df6
0x04795e06
0x04795e0c
0x04795e0f
0x04795e11
0x00000000
0x04795e1f
0x00000000
0x04795e1f
0x04795e11
0x04795df8
0x04795dfb
0x04795e00
0x00000000
0x00000000
0x04795e02
0x00000000
0x04795e02
0x0473fb32
0x0473fb35
0x0473fb3c
0x04795e26
0x04795e28
0x04795e28
0x04795e2e
0x04795e3c
0x04795e3c
0x04795e2e
0x0473fb45
0x0473fb47
0x0473fb53
0x0473fb56
0x0473fb59
0x0473fb5c
0x0473fb65
0x0474000d
0x00000000
0x0474000f
0x0474000f
0x00000000
0x0474000f
0x0473fb6b
0x0473fb6e
0x0473fb71
0x0473fb73
0x0473fb76
0x04795e45
0x04795e4b
0x04795e4b
0x04795e45
0x0473fb80
0x0473fb83
0x04795e54
0x04795e5a
0x04795e5a
0x04795e54
0x0473fb89
0x0473fb98
0x0473fb9b
0x0473fb9e
0x0473fba0
0x04795e63
0x04795e69
0x04795e69
0x04795e63
0x0473fba8
0x00000000
0x0473fbae
0x0473fbb2
0x04795e70
0x0473fbb8
0x0473fbb8
0x0473fbb8
0x0473fbbd
0x0473fbbf
0x0473fbbf
0x0473f9a8
0x0473f9a8
0x0473f9ad
0x0473f9b4
0x04795eda
0x00000000
0x00000000
0x04795ee2
0x0473f9bc
0x0473f9bc
0x0473f9bf
0x0473f9c4
0x0473fde6
0x0473fde9
0x0473fdec
0x0473fdef
0x0473fdf2
0x04795eeb
0x04795ef1
0x04795ef1
0x04795eeb
0x0473fdfa
0x00000000
0x0473fe00
0x0473fe04
0x04795efa
0x04795f00
0x04795f00
0x04795efa
0x0473fe0a
0x0473fa24
0x0473fa2a
0x0473fa2a
0x0473fdfa
0x0473f9cd
0x00000000
0x0473f9cf
0x0473f9cf
0x0473f9d1
0x0473f9d4
0x0473f9d7
0x0473f9d9
0x0473f9dc
0x0473f9df
0x0473f9e2
0x0473f9e7
0x04795f09
0x00000000
0x00000000
0x04795f11
0x0473f9ef
0x0473f9f3
0x0473fed5
0x0473fed8
0x0473fedb
0x04795f1a
0x04795f20
0x04795f20
0x04795f1a
0x0473fee3
0x00000000
0x0473fee9
0x0473feeb
0x04795f29
0x04795f2f
0x04795f2f
0x04795f29
0x0473fef3
0x00000000
0x0473fef9
0x0473fefc
0x0473ff01
0x04795f38
0x04740052
0x04740054
0x00000000
0x04740056
0x04740056
0x0473ff40
0x0473ff42
0x04795f6e
0x04795f74
0x04795f74
0x04795f6e
0x0473ff50
0x0473ff56
0x0473ff5b
0x04795f7d
0x00000000
0x00000000
0x04795f83
0x00000000
0x0473ff61
0x0473ff61
0x0473ff63
0x04740021
0x04740026
0x0474002b
0x0474007e
0x04740080
0x04740080
0x0474007e
0x0474002f
0x00000000
0x04740031
0x04740033
0x04740086
0x04740035
0x04740035
0x04740035
0x0474003c
0x00000000
0x0474003c
0x0474002f
0x0473ff69
0x0473ff6b
0x04795f8c
0x04795f92
0x04795f92
0x04795f8c
0x0473ff74
0x0473ff77
0x0473ff7b
0x04795f99
0x04795f9b
0x0473ff81
0x0473ff81
0x0473ff83
0x0473ff83
0x0473ff88
0x0473ff8b
0x0473ff90
0x0473ff92
0x0473ff92
0x0473ff9c
0x0473ffa2
0x0473ffa6
0x0473ffaa
0x0473ffad
0x0473ffb2
0x04795fa4
0x04795faa
0x04795faa
0x04795fa4
0x0473ffb8
0x00000000
0x0473ffb8
0x0473ff5b
0x04740054
0x04795f3e
0x04795f3e
0x0473ff09
0x00000000
0x00000000
0x0473ff0f
0x0473ff14
0x04795f47
0x04795f4d
0x04795f4d
0x04795f47
0x0473ff1c
0x04740046
0x04740076
0x04740078
0x00000000
0x04740048
0x04740048
0x0474004a
0x0474004a
0x00000000
0x0474004a
0x0473ff22
0x0473ff22
0x0473ff26
0x04795f56
0x04795f5c
0x04795f5c
0x04795f56
0x0473ff2e
0x00000000
0x0473ff34
0x0473ff36
0x04795f65
0x0473ff3c
0x0473ff3c
0x0473ff3c
0x0473ff3e
0x00000000
0x0473ff3e
0x0473ff2e
0x0473ff1c
0x0473fef3
0x0473fee3
0x0473f9f9
0x0473f9f9
0x0473f9fb
0x0473f9ff
0x0473fbd5
0x04795fb1
0x04795fb1
0x0473fbdf
0x00000000
0x0473fbe5
0x0473fbe5
0x0473fbe8
0x0473fbed
0x04795fdf
0x0473fc01
0x0473fc01
0x0473fc04
0x0473fc09
0x04795fee
0x04795ff4
0x04795ff4
0x04795fee
0x0473fc0f
0x0473fc13
0x0473fc1d
0x0473fc20
0x0473fc23
0x0473fc26
0x0473fc2b
0x04795ffd
0x04796003
0x04796003
0x04795ffd
0x0473fc33
0x00000000
0x0473fc39
0x0473fc3b
0x0473fc3e
0x0473fc41
0x0473fc46
0x0479600c
0x04796012
0x04796012
0x0479600c
0x0473fc4e
0x00000000
0x0473fc54
0x0473fc54
0x0473fc59
0x0479601b
0x04796021
0x04796021
0x0479601b
0x0473fc61
0x00000000
0x0473fc67
0x0473fc6a
0x0473fc6f
0x0479602a
0x04796030
0x04796030
0x0479602a
0x0473fc77
0x00000000
0x0473fc7d
0x0473fc7f
0x0473fc81
0x0473fc85
0x0473fc87
0x0473fc87
0x0473fc8c
0x0473fc8f
0x0473fc94
0x04796039
0x0473fc9c
0x0473fca4
0x0473fcaa
0x0473fcaf
0x04796046
0x0473fcbd
0x0473fcbf
0x0479606d
0x04796073
0x04796073
0x0479606d
0x0473fcc8
0x0473fccd
0x0473fccf
0x0473fcd3
0x0473fcd5
0x0473fcd5
0x0473fcde
0x0473fce1
0x0473fce3
0x0473fce3
0x0473fce8
0x0473fcf0
0x0473fcf2
0x0473fcf5
0x0473fcf7
0x0473fcff
0x0473fd02
0x0473fd06
0x0473fd11
0x0473fd14
0x0473fd17
0x0479607c
0x04796082
0x04796082
0x0479607c
0x0473fd1f
0x00000000
0x0473fd25
0x0473fd28
0x0473fd2d
0x0479608b
0x04796091
0x04796091
0x0479608b
0x0473fd35
0x00000000
0x0473fd3b
0x0473fd3e
0x0473fd43
0x0479609a
0x04740016
0x04740018
0x00000000
0x0474001a
0x0474001a
0x0473fd82
0x0473fd84
0x047960d9
0x047960df
0x047960df
0x047960d9
0x0473fd8d
0x0473fd95
0x0473fd98
0x0473fd9d
0x047960e8
0x00000000
0x00000000
0x047960ee
0x00000000
0x0473fda3
0x0473fda3
0x0473fda5
0x0473fe8b
0x0473fe90
0x0473fe95
0x047960f7
0x047960fd
0x047960fd
0x047960f7
0x0473fe9d
0x00000000
0x0473fea3
0x0473fea5
0x04796106
0x0473feab
0x0473feab
0x0473feab
0x0473feb2
0x0473feb5
0x00000000
0x0473feb5
0x0473fe9d
0x0473fdab
0x0473fdad
0x0479610f
0x04796115
0x04796115
0x0479610f
0x0473fdb6
0x0473fdbb
0x0479611e
0x04796120
0x0473fdc1
0x0473fdc1
0x0473fdc5
0x0473fdc5
0x0473fdc7
0x0473fdcc
0x0473fdce
0x0473fdce
0x0473fdd6
0x0473fdd8
0x00000000
0x0473fdd8
0x0473fd9d
0x04740018
0x047960a0
0x047960a0
0x0473fd4b
0x00000000
0x00000000
0x0473fd51
0x0473fd56
0x047960a9
0x047960af
0x047960af
0x047960a9
0x0473fd5e
0x0473febf
0x047960b8
0x0473fec5
0x0473fec5
0x0473fec5
0x0473fec7
0x00000000
0x0473fd64
0x0473fd64
0x0473fd68
0x047960c1
0x047960c7
0x047960c7
0x047960c1
0x0473fd70
0x00000000
0x0473fd76
0x0473fd78
0x047960d0
0x0473fd7e
0x0473fd7e
0x0473fd7e
0x0473fd80
0x00000000
0x0473fd80
0x0473fd70
0x0473fd5e
0x0473fd35
0x0473fd1f
0x0479604c
0x0479604c
0x0473fcb7
0x0473ffc0
0x0473ffc3
0x0473ffc6
0x0473ffcb
0x04796055
0x0479605b
0x0479605b
0x04796055
0x0473ffd3
0x00000000
0x0473ffd9
0x0473ffdb
0x04796064
0x0473ffe1
0x0473ffe1
0x0473ffe1
0x0473ffe3
0x0473ffe7
0x0473ffed
0x00000000
0x0473ffed
0x0473ffd3
0x00000000
0x0473fcb7
0x0479603f
0x0473fc9a
0x00000000
0x0473fc9a
0x0473fc77
0x0473fc61
0x0473fc4e
0x0473fc33
0x04795fe5
0x04795fe5
0x0473fbf5
0x00000000
0x00000000
0x00000000
0x00000000
0x0473fbf5
0x0473fbdf
0x0473fa05
0x0473fa05
0x0473fa0a
0x0473fe14
0x04795fb8
0x04795fb8
0x0473fe1e
0x00000000
0x0473fe24
0x00000000
0x0473fe24
0x0473fe1e
0x0473fa10
0x0473fa10
0x0473fa15
0x0473fe29
0x0473fe2d
0x0473fe35
0x0473fe38
0x0473fe3b
0x04795fc1
0x00000000
0x00000000
0x04795fc7
0x0473fe43
0x0473fe45
0x00000000
0x00000000
0x0473fe4b
0x0473fe50
0x04795fd0
0x04795fd6
0x04795fd6
0x04795fd0
0x0473fe5d
0x0473fe60
0x00000000
0x0473fe60
0x0473fe41
0x0473fe41
0x00000000
0x0473fa1b
0x0473fa1b
0x0473fa1d
0x0473fa20
0x00000000
0x0473fa20
0x0473fa15
0x0473f9ed
0x0473f9ed
0x00000000
0x0473f9ed
0x0473f9cd
0x0473f9ba
0x0473f9ba
0x00000000
0x0473f9ba
0x0473fba8
0x0473fb65
0x0473fb1d
0x0473fb23
0x0473fb26
0x00000000
0x0473fb26
0x0473faf3
0x0473faf3
0x00000000
0x0473faf3
0x0473fab4
0x0473fa79
0x0473fa56
0x0473fa56
0x00000000
0x0473fa56
0x0473f94d
0x0473f950
0x0473f955
0x04795e79
0x04795e7f
0x04795e7f
0x04795e79
0x0473f95b
0x0473f960
0x04795e88
0x04795e8a
0x04795e8a
0x04795e8e
0x04795e93
0x00000000
0x04795e99
0x04795e9c
0x04795e9f
0x04795ea1
0x04795ea3
0x04795ea3
0x04795ea7
0x00000000
0x04795ea7
0x0473f966
0x0473f966
0x0473f96b
0x04795eb0
0x04795eb6
0x04795eb6
0x04795eb0
0x0473f973
0x0473fbc7
0x0473f9a5
0x0473f9a5
0x00000000
0x0473f979
0x0473f97d
0x0473f97f
0x04795ebf
0x04795ec5
0x04795ec5
0x04795ebf
0x0473f987
0x00000000
0x0473f98d
0x0473f98d
0x0473f990
0x0473f994
0x0473f997
0x0473f99f
0x0473fff7
0x04740061
0x04740064
0x0474006a
0x04795ece
0x04795ed0
0x04795ed0
0x00000000
0x04740064
0x0473fffd
0x04740000
0x00000000
0x04740006
0x04795ecc
0x00000000
0x04795ecc
0x04740000
0x00000000
0x0473f99f
0x0473f987
0x0473f973

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction ID: 15559bde3c5ec5aeeeb445a79c8682c7129dc7dcf6e91b611b269dcf9a6e56e6
Opcode Fuzzy Hash: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction Fuzzy Hash: 8C62E432E047669BCF32CE29858027AFBA1AF85795F1986A9CC55DB343E331FC419780

Uniqueness

Uniqueness Score: -1.00%

Function 04805BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E04805BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0x4811178);
				E0478D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E04804C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E0477D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E04805542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0x48260e8;
								if( *0x48260e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0x48260e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E04779710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E04776DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E0477F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E0477F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E0477F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E0477FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E0477FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E0477F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E0477F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E04804CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E0478D130(_t427, _t494, _t511);
				}
			}

0x04805ba5
0x04805baa
0x04805baf
0x04805bb4
0x04805bb6
0x04805bbc
0x04805bbe
0x04805bc4
0x04805bcd
0x04805bd3
0x04805bd6
0x04805bdc
0x04805be0
0x04805be3
0x04805beb
0x04805bf2
0x04805bf8
0x04805bfe
0x04805c04
0x04805c0e
0x04805c18
0x04805c1f
0x04805c25
0x04805c2a
0x04805c2c
0x04805c32
0x04805c3a
0x04805c3f
0x04805c42
0x04805c48
0x04805c5b
0x04805c5b
0x04805c2c
0x04805cb7
0x04805cb9
0x04805cbf
0x04805cc2
0x04805cca
0x04805ccb
0x04805ccb
0x04805cd1
0x04805cd7
0x04805cda
0x04805ce1
0x04805ce4
0x04805ce7
0x04805ced
0x04805cf3
0x04805cf9
0x04805cff
0x04805d08
0x04805d0a
0x04805d0e
0x04805d10
0x00000000
0x00000000
0x04805d16
0x04805d1a
0x00000000
0x00000000
0x04805d20
0x04805d22
0x04805d25
0x04805d2f
0x04805d2f
0x04805d33
0x04805d3d
0x04805d49
0x04805d4b
0x00000000
0x00000000
0x04805d5a
0x04805d5d
0x04805d60
0x00000000
0x00000000
0x04805d66
0x04805d69
0x00000000
0x00000000
0x04805d6f
0x04805d6f
0x04805d73
0x04805d79
0x04805d7f
0x04805d86
0x04805d95
0x04805d98
0x04805dba
0x04805dcb
0x04805dce
0x04805dd3
0x04805dd6
0x04805dd8
0x04805de6
0x04805dec
0x04805dee
0x04805df1
0x04805df3
0x0480635a
0x0480635a
0x00000000
0x0480635a
0x04805dfe
0x04805e02
0x04805e05
0x04805e07
0x04805e10
0x04805e13
0x04805e1b
0x04805e1c
0x04805e21
0x04805e22
0x04805e23
0x04805e25
0x04805e2a
0x04805e2c
0x04805e2e
0x04805e36
0x04805e39
0x04805e42
0x04805e47
0x04805e4d
0x04805e54
0x04805e54
0x04805e54
0x04805e2e
0x04805e5c
0x04805e5f
0x04805e62
0x04805e64
0x04805e6b
0x04805e70
0x04805e7a
0x04805e7a
0x04805e7a
0x04805e6b
0x04805e7e
0x04805e7f
0x04805e7f
0x04805e81
0x04805e87
0x04805e8b
0x04805e8c
0x04805e8c
0x04805e8c
0x04805e9a
0x04805e9c
0x04805ea2
0x04805ea6
0x04805f50
0x04805f50
0x04805f57
0x04805f66
0x04805f66
0x04805f66
0x04805f68
0x04805f6a
0x048063d0
0x00000000
0x04805f70
0x04805f70
0x04805f91
0x04805f9c
0x04805f9e
0x04805fa4
0x04805fa6
0x0480638c
0x04806392
0x048063a1
0x048063a7
0x048063af
0x048063af
0x048063bd
0x048063d8
0x00000000
0x048063d8
0x04805fac
0x04805fb2
0x04805fb4
0x04805fbd
0x04805fc6
0x04805fce
0x04805fd4
0x04805fdc
0x04805fec
0x04805fed
0x04805fee
0x04805fef
0x04805ff9
0x04805ffa
0x04805ffb
0x04805ffc
0x04806000
0x04806004
0x04806012
0x04806012
0x04806018
0x04806019
0x0480601a
0x0480601b
0x0480601c
0x04806020
0x04806059
0x0480605c
0x04806061
0x04806061
0x04806022
0x04806022
0x04806022
0x04806025
0x0480602a
0x0480602b
0x04806031
0x04806037
0x04806038
0x0480603e
0x04806048
0x04806049
0x0480604a
0x0480604b
0x0480604c
0x0480604d
0x04806053
0x04806054
0x04806054
0x04806062
0x04806065
0x04806067
0x0480606a
0x04806070
0x04806075
0x04806076
0x04806081
0x04806087
0x04806095
0x04806099
0x0480609e
0x048060a4
0x048060ae
0x048060b0
0x048060b3
0x048060b6
0x048060b8
0x048060ba
0x048060ba
0x048060ba
0x048060ba
0x048060be
0x048060c0
0x048060c5
0x048060c5
0x048060c5
0x048060c6
0x048060cd
0x04806114
0x048060cf
0x048060cf
0x048060d4
0x048060d5
0x048060da
0x048060db
0x048060e1
0x048060e2
0x048060e8
0x048060f8
0x048060fd
0x048060fe
0x04806102
0x04806104
0x04806107
0x04806109
0x0480610b
0x0480610b
0x0480610b
0x0480610b
0x0480610f
0x0480610f
0x04806117
0x0480611a
0x0480611f
0x04806125
0x04806134
0x04806139
0x0480613f
0x04806146
0x04806148
0x0480614b
0x0480614d
0x0480614f
0x0480614f
0x0480614f
0x0480614f
0x04806153
0x04806159
0x04806159
0x0480615c
0x04806163
0x04806169
0x0480616c
0x04806172
0x04806181
0x04806186
0x04806187
0x0480618b
0x04806191
0x04806195
0x048061a3
0x048061bb
0x048061c0
0x048061c3
0x048061cc
0x048061d0
0x048061dc
0x048061de
0x048061e1
0x048061e4
0x048061e6
0x048061e8
0x048061e8
0x048061e8
0x048061e8
0x048061e6
0x048061ec
0x048061f3
0x04806203
0x04806209
0x0480620a
0x04806216
0x0480621d
0x04806227
0x04806241
0x04806246
0x0480624c
0x04806257
0x04806259
0x0480625c
0x0480625e
0x04806260
0x04806260
0x04806260
0x04806260
0x0480625e
0x04806264
0x04806267
0x04806269
0x04806315
0x04806315
0x0480631b
0x0480631e
0x04806324
0x04806327
0x0480632f
0x04806330
0x04806333
0x0480633a
0x0480633c
0x04806335
0x04806335
0x04806335
0x0480633f
0x04806342
0x0480634c
0x04806352
0x04806355
0x04806355
0x04806359
0x00000000
0x0480626f
0x04806275
0x04806275
0x04806278
0x0480627e
0x0480627e
0x04806281
0x04806287
0x0480628d
0x04806298
0x0480629c
0x048062a2
0x0480629e
0x0480629e
0x0480629e
0x048062a7
0x048062a7
0x048062aa
0x048062b0
0x048062f0
0x048062f0
0x048062f2
0x048062f8
0x048062fd
0x048062b2
0x048062b2
0x048062b2
0x048062b5
0x048062dd
0x048062e2
0x048062e5
0x048062b7
0x048062b8
0x048062bb
0x048062bd
0x048062c0
0x048062c4
0x048062cd
0x048062cd
0x048062c0
0x048062bb
0x048062b5
0x04806302
0x04806303
0x04806305
0x04806305
0x04806305
0x0480630c
0x0480630c
0x00000000
0x0480627e
0x04806269
0x04805eac
0x04805ebb
0x04805ebe
0x04805ecb
0x04805ecb
0x04805ece
0x04805ece
0x04805ed4
0x04805ed7
0x04805ed9
0x04805edb
0x04805edb
0x04805ee1
0x04805ee1
0x04805ee3
0x04805f20
0x04805f20
0x04805ee5
0x04805ee5
0x04805ee5
0x04805ee8
0x04805f11
0x04805f18
0x04805eea
0x04805eea
0x04805eed
0x04805ef2
0x04805ef8
0x04805efb
0x04805f0a
0x04805f0a
0x04805eed
0x04805ee8
0x04805f22
0x04805f28
0x00000000
0x00000000
0x04805f30
0x04805f31
0x04805f37
0x04805f3a
0x04805f3d
0x04805f44
0x00000000
0x00000000
0x00000000
0x04805f46
0x04805f48
0x04805f4d
0x00000000
0x04805f4d
0x04805dda
0x04805ddf
0x00000000
0x04805ddf
0x04805dd8
0x04805da7
0x04805da9
0x04805dac
0x04805dae
0x00000000
0x04805db4
0x04805db4
0x00000000
0x04805db4
0x04805dae
0x04805d88
0x04805d8d
0x04806363
0x04806369
0x0480636a
0x04806370
0x04806372
0x0480637a
0x0480637b
0x0480637d
0x00000000
0x00000000
0x0480637f
0x04806385
0x00000000
0x04806385
0x04805d38
0x04805d3b
0x00000000
0x00000000
0x00000000
0x04805d3b
0x04805d27
0x04805d29
0x00000000
0x00000000
0x00000000
0x04806360
0x00000000
0x04806360
0x04805c10
0x04805c10
0x048063da
0x048063e5
0x048063e5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25364d7bdc250bab6003072ab77458efc4676eee74901e8d8ae4d908595e8c84
Instruction ID: 14d00f449dbeb15885782041e83357d0d345f4b77c8557cd62715b99bf86da0d
Opcode Fuzzy Hash: 25364d7bdc250bab6003072ab77458efc4676eee74901e8d8ae4d908595e8c84
Instruction Fuzzy Hash: 70425A71A10229CFDB64CF68C880BA9B7B1FF45304F15C6AAD84DEB281E734A995CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04756E30, Relevance: .5, Instructions: 481
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E04756E30(signed short __ecx, signed short __edx, signed int _a4, intOrPtr* _a8, char* _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				signed short _v34;
				intOrPtr _v36;
				signed short _v38;
				signed short _v40;
				char _v41;
				signed int _v48;
				short _v50;
				signed int _v52;
				signed short _v54;
				signed int _v56;
				char _v57;
				signed int _v64;
				signed int _v68;
				signed short _v70;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed short _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				unsigned int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				char _v136;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t312;
				signed int _t313;
				char* _t315;
				unsigned int _t316;
				signed int _t317;
				short* _t319;
				void* _t320;
				signed int _t321;
				signed short _t327;
				signed int _t328;
				signed int _t335;
				signed short* _t336;
				signed int _t337;
				signed int _t338;
				signed int _t349;
				signed short _t352;
				signed int _t357;
				signed int _t360;
				signed int _t363;
				void* _t365;
				signed int _t366;
				signed short* _t367;
				signed int _t369;
				signed int _t375;
				signed int _t379;
				signed int _t384;
				signed int _t386;
				void* _t387;
				signed short _t389;
				intOrPtr* _t392;
				signed int _t397;
				unsigned int _t399;
				signed int _t401;
				signed int _t402;
				signed int _t407;
				void* _t415;
				signed short _t417;
				unsigned int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t422;
				intOrPtr* _t433;
				signed int _t435;
				void* _t436;
				signed int _t437;
				signed int _t438;
				signed int _t440;
				signed short _t443;
				void* _t444;
				signed int _t445;
				signed int _t446;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;

				_t425 = __edx;
				_push(0xfffffffe);
				_push(0x480fca8);
				_push(0x47817f0);
				_push( *[fs:0x0]);
				_t312 =  *0x482d360;
				_v12 = _v12 ^ _t312;
				_t313 = _t312 ^ _t453;
				_v32 = _t313;
				_push(_t313);
				 *[fs:0x0] =  &_v20;
				_v116 = __edx;
				_t443 = __ecx;
				_v88 = __ecx;
				_t386 = _a4;
				_t433 = _a8;
				_v112 = _t433;
				_t315 = _a12;
				_v64 = _t315;
				_t392 = _a16;
				_v108 = _t392;
				if(_t433 != 0) {
					 *_t433 = 0;
				}
				if(_t315 != 0) {
					 *_t315 = 0;
				}
				if(_t425 > 0xffff) {
					_v116 = 0xffff;
				}
				 *_t392 = 0;
				 *((intOrPtr*)(_t392 + 4)) = 0;
				_t316 =  *_t443 & 0x0000ffff;
				_v104 = _t316;
				_t435 = _t316 >> 1;
				_v120 = _t435;
				if(_t435 == 0) {
					L124:
					_t317 = 0;
					goto L60;
				} else {
					_t319 =  *((intOrPtr*)(_t443 + 4));
					if( *_t319 != 0) {
						_t397 = _t435;
						_t320 = _t319 + _t435 * 2;
						_t425 = _t320 - 2;
						while(_t397 != 0) {
							if( *_t425 == 0x20) {
								_t397 = _t397 - 1;
								_t425 = _t425 - 2;
								continue;
							}
							if(_t397 == 0) {
								goto L124;
							}
							_t321 =  *(_t320 - 2) & 0x0000ffff;
							if(_t321 == 0x5c || _t321 == 0x2f) {
								_v57 = 0;
							} else {
								_v57 = 1;
							}
							_t399 = _v116 >> 1;
							_v92 = _t399;
							_v128 = _t399;
							E0477FA60(_t386, 0, _v116);
							_v56 = 0;
							_v52 = 0;
							_v50 = _v92 + _v92;
							_v48 = _t386;
							_t327 = E047574C0(_t443);
							if(_t327 != 0) {
								_t389 = _t327 >> 0x10;
								_t328 = _t327 & 0x0000ffff;
								_v112 = _t328;
								_t437 = _v64;
								if(_t437 == 0) {
									L122:
									_t438 = _t328 + 8;
									_t401 = _v92;
									if(_t438 >= (_t401 + _t401 & 0x0000ffff)) {
										_t209 = _t438 + 2; // 0xddeeddf0
										_t402 = _t209;
										asm("sbb eax, eax");
										_t317 =  !0xffff & _t402;
									} else {
										E04769BC6( &_v52, 0x4711080);
										_t425 =  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2;
										E04779377( &_v52,  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2, _v112);
										_t317 = _t438;
									}
									goto L60;
								}
								if(_t389 != 0) {
									_t425 = _t389;
									_t335 = E047B46A7(_t443, _t389, _t437);
									if(_t335 < 0) {
										goto L124;
									}
									if( *_t437 != 0) {
										goto L124;
									}
									_t328 = _v112;
								}
								goto L122;
							} else {
								_t425 = _t443;
								_t336 =  *(_t425 + 4);
								_t407 =  *_t425 & 0x0000ffff;
								if(_t407 < 2) {
									L17:
									if(_t407 < 4 ||  *_t336 == 0 || _t336[1] != 0x3a) {
										_t337 = 5;
									} else {
										if(_t407 < 6) {
											L98:
											_t337 = 3;
											L23:
											 *_v108 = _t337;
											_t409 = 0;
											_v72 = 0;
											_v68 = 0;
											_v64 = 0;
											_v84 = 0;
											_v41 = 0;
											_t445 = 0;
											_v76 = 0;
											_v8 = 0;
											if(_t337 != 2) {
												_t338 = _t337 - 1;
												if(_t338 > 6) {
													L164:
													_t446 = 0;
													_v64 = 0;
													_t439 = _v92;
													goto L59;
												}
												switch( *((intOrPtr*)(_t338 * 4 +  &M0475749C))) {
													case 0:
														__ecx = 0;
														__eflags = 0;
														_v124 = 0;
														__esi = 2;
														while(1) {
															_v100 = __esi;
															__eflags = __esi - __edi;
															if(__esi >= __edi) {
																break;
															}
															__eax =  *(__edx + 4);
															__eax =  *( *(__edx + 4) + __esi * 2) & 0x0000ffff;
															__eflags = __eax - 0x5c;
															if(__eax == 0x5c) {
																L140:
																__ecx = __ecx + 1;
																_v124 = __ecx;
																__eflags = __ecx - 2;
																if(__ecx == 2) {
																	break;
																}
																L141:
																__esi = __esi + 1;
																continue;
															}
															__eflags = __eax - 0x2f;
															if(__eax != 0x2f) {
																goto L141;
															}
															goto L140;
														}
														__eax = __esi;
														_v80 = __esi;
														__eax =  *(__edx + 4);
														_v68 =  *(__edx + 4);
														__eax = __esi + __esi;
														_v72 = __ax;
														__eax =  *(__edx + 2) & 0x0000ffff;
														_v70 = __ax;
														_v76 = __esi;
														goto L80;
													case 1:
														goto L164;
													case 2:
														__eax = E047352A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
														} else {
															__ebx = __eax + 0xc;
														}
														 *(__ebx + 4) =  *( *(__ebx + 4)) & 0x0000ffff;
														__eax = L04742600( *( *(__ebx + 4)) & 0x0000ffff);
														__si = __ax;
														_v88 =  *(_v88 + 4);
														__ecx =  *( *(_v88 + 4)) & 0x0000ffff;
														__eax = L04742600( *( *(_v88 + 4)) & 0x0000ffff);
														_v54 = __ax;
														__eflags = __ax - __ax;
														if(__eflags != 0) {
															__cx = __ax;
															L047B4735(__ecx, __edx, __eflags) = 0x3d;
															_v40 = __ax;
															__si = _v54;
															_v38 = __si;
															_v36 = 0x3a;
															 &_v40 =  &_v136;
															E0477BB40(__ecx,  &_v136,  &_v40) =  &_v52;
															__eax =  &_v136;
															__eax = E04762010(__ecx, 0,  &_v136,  &_v52);
															__eflags = __eax;
															if(__eax >= 0) {
																__ax = _v52;
																_v56 = __eax;
																__edx = __ax & 0x0000ffff;
																__ecx = __edx;
																__ecx = __edx >> 1;
																_v100 = __ecx;
																__eflags = __ecx - 3;
																if(__ecx <= 3) {
																	L155:
																	__ebx = _v48;
																	L156:
																	_v72 = __ax;
																	goto L119;
																}
																__eflags = __ecx - _v92;
																if(__ecx >= _v92) {
																	goto L155;
																}
																__esi = 0x5c;
																__ebx = _v48;
																 *(__ebx + __ecx * 2) = __si;
																__eax = __edx + 2;
																_v56 = __edx + 2;
																_v52 = __ax;
																goto L156;
															}
															__eflags = __eax - 0xc0000023;
															if(__eax != 0xc0000023) {
																__eax = 0;
																_v52 = __ax;
																_v40 = __si;
																_v38 = 0x5c003a;
																_v34 = __ax;
																__edx =  &_v40;
																__ecx =  &_v52;
																L047B4658(__ecx,  &_v40) = 8;
																_v72 = __ax;
																__ebx = _v48;
																__ax = _v52;
																_v56 = 8;
																goto L119;
															}
															__ax = _v52;
															_v56 = __eax;
															__eax = __ax & 0x0000ffff;
															__eax = (__ax & 0x0000ffff) + 2;
															_v64 = __eax;
															__eflags = __eax - 0xffff;
															if(__eax <= 0xffff) {
																_v72 = __ax;
																__ebx = _v48;
																goto L119;
															}
															__esi = 0;
															_v64 = 0;
															__ebx = _v48;
															__edi = _v92;
															goto L58;
														} else {
															__eax =  *__ebx;
															_v72 =  *__ebx;
															__eax =  *(__ebx + 4);
															_v68 =  *(__ebx + 4);
															__edx =  &_v72;
															__ecx =  &_v52;
															__eax = E04769BC6(__ecx,  &_v72);
															__ebx = _v48;
															__eax = _v52 & 0x0000ffff;
															_v56 = _v52 & 0x0000ffff;
															L119:
															__eax = 3;
															_v80 = 3;
															__esi = 2;
															_v76 = 2;
															__edx = _v88;
															goto L25;
														}
													case 3:
														__eax = E047352A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
															__eflags = __ebx;
															__esi = _v76;
														} else {
															__ebx = __eax + 0xc;
														}
														__ecx = __ebx;
														__eax = L047383AE(__ebx);
														_v80 = __eax;
														__ecx =  *__ebx;
														_v72 =  *__ebx;
														__ecx =  *(__ebx + 4);
														_v68 = __ecx;
														__eflags = __eax - 3;
														if(__eax == 3) {
															__eax = 4;
															_v72 = __ax;
														} else {
															__ecx = __eax + __eax;
															_v72 = __cx;
														}
														goto L80;
													case 4:
														_t340 = E047352A5(0);
														_v84 = _t340;
														_v41 = 1;
														__eflags = _t340;
														if(_t340 == 0) {
															_t428 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
															_t445 = _v76;
														} else {
															_t428 = _t340 + 0xc;
															 *((intOrPtr*)(_v108 + 4)) =  *((intOrPtr*)(_t340 + 0x14));
														}
														_v72 =  *_t428;
														_v68 = _t428[2];
														_v80 = L047383AE(_t428);
														L80:
														E04769BC6( &_v52,  &_v72);
														_t386 = _v48;
														_v56 = _v52 & 0x0000ffff;
														_t425 = _v88;
														goto L25;
													case 5:
														__eax = 4;
														_v80 = 4;
														__esi = 4;
														_v76 = 4;
														__eflags = __edi - 4;
														if(__edi < 4) {
															__esi = __edi;
															_v76 = __esi;
														}
														__eax =  *0x4711080;
														_v72 =  *0x4711080;
														__eax =  *0x4711084;
														_v68 =  *0x4711084;
														__edx =  &_v72;
														__ecx =  &_v52;
														__eax = E04769BC6(__ecx,  &_v72);
														__eax = _v52 & 0x0000ffff;
														_v56 = __eax;
														__edx = _v88;
														__ebx = _v48;
														__eflags = __eax - 6;
														if(__eax >= 6) {
															__eax =  *(__edx + 4);
															__ax =  *((intOrPtr*)(__eax + 4));
															 *(__ebx + 4) =  *((intOrPtr*)(__eax + 4));
														}
														__eax = _v108;
														__eflags =  *_v108 - 7;
														if( *_v108 == 7) {
															_v57 = 0;
														}
														goto L25;
												}
											} else {
												_v80 = 3;
												L25:
												_t349 = _v104 + (_v72 & 0x0000ffff) - _t445 + _t445;
												_v104 = _t349;
												_t415 = _t349 + 2;
												if(_t415 > _v116) {
													if(_t435 <= 1) {
														if( *( *(_t425 + 4)) != 0x2e) {
															goto L72;
														}
														if(_t435 != 1) {
															asm("sbb esi, esi");
															_t446 =  !_t445 & _v104;
															_v64 = _t446;
															_t439 = _v92;
															L58:
															_t409 = _v84;
															L59:
															_v8 = 0xfffffffe;
															E0475746D(_t386, _t409, _t439, _t446);
															_t317 = _t446;
															L60:
															 *[fs:0x0] = _v20;
															_pop(_t436);
															_pop(_t444);
															_pop(_t387);
															return E0477B640(_t317, _t387, _v32 ^ _t453, _t425, _t436, _t444);
														}
														_t417 = _v72;
														if(_t417 != 8) {
															if(_v116 >= (_t417 & 0x0000ffff)) {
																_t352 = _v56;
																_t418 = _t352 & 0x0000ffff;
																_v104 = _t418;
																_t419 = _t418 >> 1;
																_v100 = _t419;
																if(_t419 != 0) {
																	if( *((short*)(_t386 + _t419 * 2 - 2)) == 0x5c) {
																		_t352 = _v104 + 0xfffffffe;
																		_v56 = _t352;
																		_v52 = _t352;
																	}
																}
																L27:
																_t420 = 0;
																_v100 = 0;
																L28:
																L28:
																if(_t420 < (_t352 & 0x0000ffff) >> 1) {
																	goto L69;
																} else {
																	_t422 = (_v56 & 0x0000ffff) >> 1;
																	_v96 = _t422;
																}
																while(_t445 < _t435) {
																	_t363 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																	if(_t363 == 0x5c) {
																		L44:
																		if(_t422 == 0) {
																			L46:
																			 *(_t386 + _t422 * 2) = 0x5c;
																			_t422 = _t422 + 1;
																			_v96 = _t422;
																			L43:
																			_t445 = _t445 + 1;
																			_v76 = _t445;
																			continue;
																		}
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			goto L43;
																		}
																		goto L46;
																	}
																	_t365 = _t363 - 0x2e;
																	if(_t365 == 0) {
																		_t126 = _t445 + 1; // 0x2
																		_t366 = _t126;
																		_v104 = _t366;
																		if(_t366 == _t435) {
																			goto L43;
																		}
																		_t367 =  *(_t425 + 4);
																		_t440 =  *(_t367 + 2 + _t445 * 2) & 0x0000ffff;
																		_v108 = _t440;
																		_t435 = _v120;
																		if(_t440 != 0x5c) {
																			if(_v108 == 0x2f) {
																				goto L83;
																			}
																			if(_v108 != 0x2e) {
																				L35:
																				while(_t445 < _t435) {
																					_t369 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																					if(_t369 == 0x5c || _t369 == 0x2f) {
																						if(_t445 < _t435) {
																							if(_t422 >= 2) {
																								if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x2e) {
																									if( *((short*)(_t386 + _t422 * 2 - 4)) != 0x2e) {
																										_t422 = _t422 - 1;
																										_v96 = _t422;
																									}
																								}
																							}
																						}
																						break;
																					} else {
																						 *(_t386 + _t422 * 2) = _t369;
																						_t422 = _t422 + 1;
																						_v96 = _t422;
																						_t445 = _t445 + 1;
																						_v76 = _t445;
																						continue;
																					}
																				}
																				_t445 = _t445 - 1;
																				_v76 = _t445;
																				goto L43;
																			}
																			_t155 = _t445 + 2; // 0x3
																			_t425 = _v88;
																			if(_t155 == _t435) {
																				while(1) {
																					L103:
																					if(_t422 < _v80) {
																						break;
																					}
																					 *(_t386 + _t422 * 2) = 0;
																					_t425 = _v88;
																					if( *(_t386 + _t422 * 2) != 0x5c) {
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																						continue;
																					} else {
																						goto L105;
																					}
																					while(1) {
																						L105:
																						if(_t422 < _v80) {
																							goto L180;
																						}
																						 *(_t386 + _t422 * 2) = 0;
																						_t435 = _v120;
																						if( *(_t386 + _t422 * 2) == 0x5c) {
																							if(_t422 < _v80) {
																								goto L180;
																							}
																							L110:
																							_t445 = _t445 + 1;
																							_v76 = _t445;
																							goto L43;
																						}
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																					}
																					break;
																				}
																				L180:
																				_t422 = _t422 + 1;
																				_v96 = _t422;
																				goto L110;
																			}
																			_t375 =  *(_t367 + 4 + _t445 * 2) & 0x0000ffff;
																			if(_t375 != 0x5c) {
																				if(_t375 != 0x2f) {
																					goto L35;
																				}
																			}
																			goto L103;
																		}
																		L83:
																		_t445 = _v104;
																		_v76 = _t445;
																		goto L43;
																	}
																	if(_t365 == 1) {
																		goto L44;
																	} else {
																		goto L35;
																	}
																}
																_t449 = _v80;
																if(_v57 != 0) {
																	if(_t422 > _t449) {
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			_t422 = _t422 - 1;
																			_v96 = _t422;
																		}
																	}
																}
																_t439 = _v92;
																if(_t422 >= _v92) {
																	L52:
																	if(_t422 == 0) {
																		L56:
																		_t425 = _t422 + _t422;
																		_v52 = _t425;
																		if(_v112 != 0) {
																			_t357 = _t422;
																			while(1) {
																				_v100 = _t357;
																				if(_t357 == 0) {
																					break;
																				}
																				if( *((short*)(_t386 + _t357 * 2 - 2)) == 0x5c) {
																					break;
																				}
																				_t357 = _t357 - 1;
																			}
																			if(_t357 >= _t422) {
																				L113:
																				 *_v112 = 0;
																				goto L57;
																			}
																			if(_t357 < _t449) {
																				goto L113;
																			}
																			 *_v112 = _t386 + _t357 * 2;
																		}
																		L57:
																		_t446 = _t425 & 0x0000ffff;
																		_v64 = _t446;
																		goto L58;
																	}
																	_t422 = _t422 - 1;
																	_v96 = _t422;
																	_t360 =  *(_t386 + _t422 * 2) & 0x0000ffff;
																	if(_t360 == 0x20) {
																		goto L51;
																	}
																	if(_t360 == 0x2e) {
																		goto L51;
																	}
																	_t422 = _t422 + 1;
																	_v96 = _t422;
																	goto L56;
																} else {
																	L51:
																	 *(_t386 + _t422 * 2) = 0;
																	goto L52;
																}
																L69:
																if( *((short*)(_t386 + _t420 * 2)) == 0x2f) {
																	 *((short*)(_t386 + _t420 * 2)) = 0x5c;
																}
																_t420 = _t420 + 1;
																_v100 = _t420;
																_t352 = _v56;
																goto L28;
															}
															_t446 = _t417 & 0x0000ffff;
															_v64 = _t446;
															_t439 = _v92;
															goto L58;
														}
														if(_v116 > 8) {
															goto L26;
														}
														_t446 = 0xa;
														_v64 = 0xa;
														_t439 = _v92;
														goto L58;
													}
													L72:
													if(_t415 > 0xffff) {
														_t446 = 0;
													}
													_v64 = _t446;
													_t439 = _v92;
													goto L58;
												}
												L26:
												_t352 = _v56;
												goto L27;
											}
										}
										_t379 = _t336[2] & 0x0000ffff;
										if(_t379 != 0x5c) {
											if(_t379 == 0x2f) {
												goto L22;
											}
											goto L98;
										}
										L22:
										_t337 = 2;
									}
									goto L23;
								}
								_t450 =  *_t336 & 0x0000ffff;
								if(_t450 == 0x5c || _t450 == 0x2f) {
									if(_t407 < 4) {
										L132:
										_t337 = 4;
										goto L23;
									}
									_t451 = _t336[1] & 0x0000ffff;
									if(_t451 != 0x5c) {
										if(_t451 == 0x2f) {
											goto L87;
										}
										goto L132;
									}
									L87:
									if(_t407 < 6) {
										L135:
										_t337 = 1;
										goto L23;
									}
									_t452 = _t336[2] & 0x0000ffff;
									if(_t452 != 0x2e) {
										if(_t452 == 0x3f) {
											goto L89;
										}
										goto L135;
									}
									L89:
									if(_t407 < 8) {
										L134:
										_t337 = ((0 | _t407 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
										goto L23;
									}
									_t384 = _t336[3] & 0x0000ffff;
									if(_t384 != 0x5c) {
										if(_t384 == 0x2f) {
											goto L91;
										}
										goto L134;
									}
									L91:
									_t337 = 6;
									goto L23;
								} else {
									goto L17;
								}
							}
						}
					}
					goto L124;
				}
			}

0x04756e30
0x04756e35
0x04756e37
0x04756e3c
0x04756e47
0x04756e4b
0x04756e50
0x04756e53
0x04756e55
0x04756e5b
0x04756e5f
0x04756e65
0x04756e68
0x04756e6a
0x04756e6d
0x04756e70
0x04756e73
0x04756e76
0x04756e79
0x04756e7c
0x04756e7f
0x04756e84
0x0475710f
0x0475710f
0x04756e8c
0x04756e8e
0x04756e8e
0x04756e97
0x0479f5d3
0x0479f5d3
0x04756e9d
0x04756ea3
0x04756eaa
0x04756ead
0x04756eb2
0x04756eb4
0x04756eb7
0x04757466
0x04757466
0x00000000
0x04756ebd
0x04756ebd
0x04756ec4
0x04756eca
0x04756ecc
0x04756ecf
0x04756ed2
0x04756ede
0x0479f5df
0x0479f5e0
0x00000000
0x0479f5e0
0x04756ee6
0x00000000
0x00000000
0x04756eec
0x04756ef3
0x04757181
0x04756f02
0x04756f02
0x04756f02
0x04756f0b
0x04756f0d
0x04756f10
0x04756f17
0x04756f21
0x04756f24
0x04756f2d
0x04756f31
0x04756f36
0x04756f3d
0x04757413
0x04757416
0x04757419
0x0475741c
0x04757421
0x0475742b
0x0475742b
0x0475742e
0x04757439
0x0479f60b
0x0479f60b
0x0479f615
0x0479f619
0x0475743f
0x04757447
0x04757454
0x0475745a
0x0475745f
0x0475745f
0x00000000
0x04757439
0x04757425
0x0479f5e9
0x0479f5ed
0x0479f5f4
0x00000000
0x00000000
0x0479f5fd
0x00000000
0x00000000
0x0479f603
0x0479f603
0x00000000
0x04756f43
0x04756f43
0x04756f45
0x04756f48
0x04756f4e
0x04756f65
0x04756f68
0x0475721f
0x04756f83
0x04756f86
0x047572dc
0x047572dc
0x04756f9e
0x04756fa1
0x04756fa3
0x04756fa5
0x04756fa8
0x04756fab
0x04756fae
0x04756fb1
0x04756fb4
0x04756fb6
0x04756fb9
0x04756fbf
0x0475718a
0x0475718e
0x0479f831
0x0479f831
0x0479f833
0x0479f836
0x00000000
0x0479f836
0x04757194
0x00000000
0x0479f658
0x0479f658
0x0479f65a
0x0479f65d
0x0479f662
0x0479f662
0x0479f665
0x0479f667
0x00000000
0x00000000
0x0479f669
0x0479f66c
0x0479f670
0x0479f673
0x0479f67a
0x0479f67a
0x0479f67b
0x0479f67e
0x0479f681
0x00000000
0x00000000
0x0479f683
0x0479f683
0x00000000
0x0479f683
0x0479f675
0x0479f678
0x00000000
0x00000000
0x00000000
0x0479f678
0x0479f686
0x0479f688
0x0479f68b
0x0479f68e
0x0479f691
0x0479f694
0x0479f698
0x0479f69c
0x0479f6a0
0x00000000
0x00000000
0x00000000
0x00000000
0x04757397
0x0475739c
0x0475739f
0x047573a3
0x047573a5
0x0479f6bb
0x0479f6c1
0x0479f6c4
0x047573ab
0x047573ab
0x047573ab
0x047573b1
0x047573b5
0x047573ba
0x047573c0
0x047573c3
0x047573c7
0x047573cc
0x047573d0
0x047573d3
0x0479f6cc
0x0479f6d4
0x0479f6d9
0x0479f6dd
0x0479f6e1
0x0479f6e5
0x0479f6f0
0x0479f6fc
0x0479f700
0x0479f709
0x0479f70e
0x0479f710
0x0479f784
0x0479f788
0x0479f78b
0x0479f78e
0x0479f790
0x0479f792
0x0479f795
0x0479f798
0x0479f7b7
0x0479f7b7
0x0479f7ba
0x0479f7ba
0x00000000
0x0479f7ba
0x0479f79a
0x0479f79d
0x00000000
0x00000000
0x0479f79f
0x0479f7a4
0x0479f7a7
0x0479f7ab
0x0479f7ae
0x0479f7b1
0x00000000
0x0479f7b1
0x0479f712
0x0479f717
0x0479f74c
0x0479f74e
0x0479f752
0x0479f756
0x0479f75d
0x0479f761
0x0479f764
0x0479f76c
0x0479f771
0x0479f775
0x0479f778
0x0479f77c
0x00000000
0x0479f77c
0x0479f719
0x0479f71d
0x0479f720
0x0479f723
0x0479f726
0x0479f729
0x0479f72e
0x0479f740
0x0479f744
0x00000000
0x0479f744
0x0479f730
0x0479f732
0x0479f735
0x0479f738
0x00000000
0x047573d9
0x047573d9
0x047573db
0x047573de
0x047573e1
0x047573e4
0x047573e7
0x047573ea
0x047573ef
0x047573f2
0x047573f6
0x047573f9
0x047573f9
0x047573fe
0x04757401
0x04757406
0x04757409
0x00000000
0x04757409
0x00000000
0x0479f7c5
0x0479f7ca
0x0479f7cd
0x0479f7d1
0x0479f7d3
0x0479f7da
0x0479f7e0
0x0479f7e3
0x0479f7e3
0x0479f7e6
0x0479f7d5
0x0479f7d5
0x0479f7d5
0x0479f7e9
0x0479f7eb
0x0479f7f0
0x0479f7f3
0x0479f7f5
0x0479f7f8
0x0479f7fb
0x0479f7fe
0x0479f801
0x0479f80f
0x0479f814
0x0479f803
0x0479f803
0x0479f806
0x0479f806
0x00000000
0x00000000
0x0475719d
0x047571a2
0x047571a5
0x047571a9
0x047571ab
0x0479f826
0x0479f829
0x047571b1
0x047571b1
0x047571ba
0x047571ba
0x047571bf
0x047571c5
0x047571cf
0x047571d2
0x047571d8
0x047571dd
0x047571e4
0x047571e7
0x00000000
0x00000000
0x04757275
0x0475727a
0x0475727d
0x0475727f
0x04757282
0x04757284
0x0479f6a8
0x0479f6aa
0x0479f6aa
0x0475728a
0x0475728f
0x04757292
0x04757297
0x0475729a
0x0475729d
0x047572a0
0x047572a5
0x047572a9
0x047572ac
0x047572af
0x047572b2
0x047572b5
0x047572b7
0x047572ba
0x047572be
0x047572be
0x047572c2
0x047572c5
0x047572c8
0x0479f6b2
0x0479f6b2
0x00000000
0x00000000
0x04756fc5
0x04756fc5
0x04756fcc
0x04756fd8
0x04756fda
0x04756fdd
0x04756fe3
0x04757162
0x0479f845
0x00000000
0x00000000
0x0479f84e
0x0479f8c4
0x0479f8c8
0x0479f8cb
0x0479f8ce
0x047570e0
0x047570e0
0x047570e3
0x047570e3
0x047570ea
0x047570ef
0x047570f1
0x047570f4
0x047570fc
0x047570fd
0x047570fe
0x0475710c
0x0475710c
0x0479f850
0x0479f858
0x0479f87a
0x0479f88a
0x0479f88d
0x0479f890
0x0479f893
0x0479f895
0x0479f898
0x0479f8a4
0x0479f8ad
0x0479f8b0
0x0479f8b3
0x0479f8b3
0x0479f8a4
0x04756fec
0x04756fec
0x04756fee
0x00000000
0x04756ff1
0x04756ff8
0x00000000
0x04756ffe
0x04757004
0x04757006
0x04757006
0x04757010
0x04757017
0x0475701e
0x04757072
0x04757074
0x0475707e
0x04757083
0x04757087
0x04757088
0x0475706c
0x0475706c
0x0475706d
0x00000000
0x0475706d
0x0475707c
0x00000000
0x00000000
0x00000000
0x0475707c
0x04757020
0x04757023
0x047571ef
0x047571ef
0x047571f2
0x047571f7
0x00000000
0x00000000
0x047571fd
0x04757200
0x04757205
0x0475720b
0x0475720e
0x047572eb
0x00000000
0x00000000
0x047572f6
0x00000000
0x04757030
0x04757037
0x0475703e
0x04757055
0x0475705a
0x04757062
0x0479f908
0x0479f90e
0x0479f90f
0x0479f90f
0x0479f908
0x04757062
0x0475705a
0x00000000
0x04757045
0x04757045
0x04757049
0x0475704a
0x0475704d
0x0475704e
0x00000000
0x0475704e
0x0475703e
0x04757068
0x04757069
0x00000000
0x04757069
0x047572fc
0x04757301
0x04757304
0x04757314
0x04757314
0x04757319
0x00000000
0x00000000
0x04757325
0x0475732d
0x04757330
0x04757356
0x04757357
0x00000000
0x00000000
0x00000000
0x00000000
0x04757332
0x04757332
0x04757337
0x00000000
0x00000000
0x04757343
0x0475734b
0x0475734e
0x04757361
0x00000000
0x00000000
0x04757367
0x04757367
0x04757368
0x00000000
0x04757368
0x04757350
0x04757351
0x04757351
0x00000000
0x04757332
0x0479f8f9
0x0479f8f9
0x0479f8fa
0x00000000
0x0479f8fa
0x04757306
0x0475730e
0x0479f8ee
0x00000000
0x00000000
0x0479f8f4
0x00000000
0x0475730e
0x04757214
0x04757214
0x04757217
0x00000000
0x04757217
0x0475702c
0x00000000
0x00000000
0x00000000
0x00000000
0x0475702c
0x0475708d
0x04757094
0x04757098
0x047570a0
0x0475738c
0x0475738d
0x0475738d
0x047570a0
0x04757098
0x047570a6
0x047570ab
0x047570b3
0x047570b5
0x047570cd
0x047570cd
0x047570d0
0x047570d8
0x0475711a
0x0475711c
0x0475711c
0x04757121
0x00000000
0x00000000
0x04757129
0x00000000
0x00000000
0x0475712b
0x0475712b
0x04757130
0x0475737e
0x04757381
0x00000000
0x04757381
0x04757138
0x00000000
0x00000000
0x04757144
0x04757144
0x047570da
0x047570da
0x047570dd
0x00000000
0x047570dd
0x047570b7
0x047570b8
0x047570bb
0x047570c2
0x00000000
0x00000000
0x047570c7
0x00000000
0x00000000
0x047570c9
0x047570ca
0x00000000
0x047570ad
0x047570ad
0x047570af
0x00000000
0x047570af
0x04757148
0x0475714d
0x0479f8e2
0x0479f8e2
0x04757153
0x04757154
0x04757157
0x00000000
0x04757157
0x0479f87c
0x0479f87f
0x0479f882
0x00000000
0x0479f882
0x0479f85e
0x00000000
0x00000000
0x0479f864
0x0479f869
0x0479f86c
0x00000000
0x0479f86c
0x04757168
0x04757170
0x0479f8d6
0x0479f8d6
0x04757176
0x04757179
0x00000000
0x04757179
0x04756fe9
0x04756fe9
0x00000000
0x04756fe9
0x04756fbf
0x04756f8c
0x04756f93
0x047572d6
0x00000000
0x00000000
0x00000000
0x047572d6
0x04756f99
0x04756f99
0x04756f99
0x00000000
0x04756f68
0x04756f50
0x04756f56
0x0475722c
0x0479f629
0x0479f629
0x00000000
0x0479f629
0x04757232
0x04757239
0x0479f623
0x00000000
0x00000000
0x00000000
0x0479f623
0x0475723f
0x04757242
0x0479f64e
0x0479f64e
0x00000000
0x0479f64e
0x04757248
0x0475724f
0x04757373
0x00000000
0x00000000
0x00000000
0x04757379
0x04757255
0x04757258
0x0479f63c
0x0479f648
0x00000000
0x0479f648
0x0475725e
0x04757265
0x0479f636
0x00000000
0x00000000
0x00000000
0x0479f636
0x0475726b
0x0475726b
0x00000000
0x00000000
0x00000000
0x00000000
0x04756f56
0x04756f3d
0x04756ed2
0x00000000
0x04756ec4

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3141427cf750035965ff4e5331d399fa955e9e2a5a1a169413a04c93f77e2451
Instruction ID: 3003f90366ecf70ccc6706b7f1912223689ab5db9b1019b27730a8a9a4d4355b
Opcode Fuzzy Hash: 3141427cf750035965ff4e5331d399fa955e9e2a5a1a169413a04c93f77e2451
Instruction Fuzzy Hash: 99025F71E142558BCF2C8F99D4846ADB7F1AF44700F65852EEC19EF3A1E7B0A881CB94

Uniqueness

Uniqueness Score: -1.00%

Function 04754120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E04754120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x482d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E0476F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E04756E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L04754620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E04756E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M047545F8))) {
												case 0:
													_v568 = 0x4711078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x47111c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L04754620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E0477F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E0477F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E047352A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E0474EB70(1, 0x48279a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E0474AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E047795D0();
																			L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E0477B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E04773D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E0477B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x04754128
0x04754135
0x0475413c
0x04754141
0x04754145
0x04754147
0x0475414e
0x04754151
0x04754159
0x0475415c
0x04754160
0x04754164
0x04754168
0x0475416c
0x0475417f
0x04754181
0x0475446a
0x0475446a
0x0475418c
0x04754195
0x04754199
0x04754432
0x04754439
0x0475443d
0x04754442
0x04754447
0x00000000
0x0475419f
0x047541a3
0x047541b1
0x047541b9
0x047541bd
0x047545db
0x047545db
0x00000000
0x047541c3
0x047541c3
0x047541ce
0x047541d4
0x0479e138
0x0479e13e
0x0479e169
0x0479e16d
0x0479e19e
0x0479e16f
0x0479e16f
0x0479e175
0x0479e179
0x0479e18f
0x0479e193
0x00000000
0x0479e199
0x00000000
0x0479e199
0x0479e193
0x00000000
0x00000000
0x00000000
0x047541da
0x047541da
0x047541df
0x047541e4
0x047541ec
0x04754203
0x04754207
0x0479e1fd
0x04754222
0x04754226
0x0479e1f3
0x0479e1f3
0x0475422c
0x0475422c
0x04754233
0x0479e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04754239
0x04754239
0x04754239
0x04754239
0x04754233
0x04754226
0x047541ee
0x047541ee
0x047541f4
0x04754575
0x0479e1b1
0x0479e1b1
0x00000000
0x0475457b
0x0475457b
0x04754582
0x0479e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x04754588
0x04754588
0x0475458c
0x0479e1c4
0x0479e1c4
0x00000000
0x04754592
0x04754592
0x04754599
0x0479e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x0475459f
0x0475459f
0x047545a3
0x0479e1d7
0x0479e1e4
0x00000000
0x047545a9
0x047545a9
0x047545b0
0x0479e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x047545b6
0x047545b6
0x047545b6
0x00000000
0x047545b6
0x047545b0
0x047545a3
0x04754599
0x0475458c
0x04754582
0x00000000
0x00000000
0x00000000
0x00000000
0x047541f4
0x0475423e
0x04754241
0x047545c0
0x047545c4
0x00000000
0x047545ca
0x047545ca
0x00000000
0x0479e207
0x0479e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x047545d1
0x00000000
0x00000000
0x047545ca
0x00000000
0x04754247
0x04754247
0x04754247
0x04754249
0x04754249
0x04754249
0x04754251
0x04754251
0x04754257
0x0475425f
0x0475426e
0x04754270
0x0475427a
0x0479e219
0x0479e219
0x04754280
0x04754282
0x04754456
0x047545ea
0x00000000
0x047545f0
0x0479e223
0x00000000
0x0479e223
0x0475445c
0x0475445c
0x00000000
0x0475445c
0x00000000
0x04754288
0x0475428c
0x0479e298
0x04754292
0x04754292
0x0475429e
0x047542a3
0x047542a7
0x047542ac
0x0479e22d
0x047542b2
0x047542b2
0x047542b9
0x047542bc
0x047542c2
0x047542ca
0x047542cd
0x047542cd
0x047542d4
0x0475433f
0x0475433f
0x047542d6
0x047542d6
0x047542d9
0x047542dd
0x047542eb
0x0479e23a
0x047542f1
0x04754305
0x0475430d
0x04754315
0x04754318
0x0475431f
0x04754322
0x0475432e
0x0475433b
0x0475433b
0x00000000
0x0475432e
0x047542eb
0x0475434c
0x0475434e
0x04754352
0x04754359
0x0475435e
0x04754361
0x0475436e
0x0475438a
0x0475438e
0x04754396
0x0475439e
0x047543a1
0x047543ad
0x047543bb
0x047543bb
0x047543ad
0x0475436e
0x047543bf
0x047543c5
0x04754463
0x04754463
0x047543ce
0x047543d5
0x047543d9
0x047543df
0x04754475
0x04754479
0x04754491
0x04754491
0x04754479
0x047543e5
0x047543eb
0x047543f4
0x047543f6
0x047543f9
0x047543fc
0x047543ff
0x047544e8
0x047544ed
0x047544f3
0x0479e247
0x00000000
0x047544f9
0x04754504
0x04754508
0x0475450f
0x0479e269
0x00000000
0x04754515
0x04754519
0x04754531
0x04754534
0x04754537
0x0475453e
0x04754541
0x0475454a
0x0479e255
0x0479e255
0x0479e25b
0x0479e25e
0x0479e261
0x0479e261
0x04754555
0x04754559
0x0475455d
0x0479e26d
0x0479e270
0x0479e274
0x0479e27a
0x0479e27d
0x0479e28e
0x0479e28e
0x04754563
0x04754563
0x04754569
0x04754569
0x00000000
0x0475455d
0x0475450f
0x00000000
0x047544f3
0x047543ff
0x04754405
0x04754405
0x04754405
0x047542ac
0x0475428c
0x04754282
0x04754407
0x0475440d
0x0479e2af
0x0479e2af
0x04754413
0x04754413
0x00000000
0x047541d4
0x00000000
0x047541c3
0x047541bd
0x04754415
0x04754415
0x04754416
0x04754417
0x04754429
0x0475416e
0x0475416e
0x04754175
0x04754498
0x0475449f
0x0479e12d
0x00000000
0x0479e133
0x00000000
0x0479e133
0x047544a5
0x047544a5
0x047544aa
0x00000000
0x047544bb
0x047544ca
0x047544d6
0x047544d7
0x047544d8
0x047544e3
0x047544e3
0x047544aa
0x0475417b
0x0475417b
0x0475417b
0x00000000
0x0475417b
0x04754175
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac2898e81afb707c249e5ed99210781724e5cc344fbd697d283471176aef2342
Instruction ID: afb954ce099eddd59cd9aab775bbd510bbb55c7b2f644d5fd88baa1295e1fe6a
Opcode Fuzzy Hash: ac2898e81afb707c249e5ed99210781724e5cc344fbd697d283471176aef2342
Instruction Fuzzy Hash: A3F170706082518BDB24CF19D584B3AB7E1FF88714F54492EF886CB3A0E774E991DB92

Uniqueness

Uniqueness Score: -1.00%

Function 047620A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E047620A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x4828714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E04762EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E04762EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E047358EC(_t240);
									_t221 =  *0x4825cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x4825cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E04774A2C(0x4826e40, 0x4774b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E04757D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x4715c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E0476F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E0476F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E047B7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L04752400(_t267 + 0x20);
															}
															L04752400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E04762397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E04752280(_t134, 0x4828608);
									__eflags =  *0x4826e48 - _t253; // 0x80b110
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E0474FFB0(_t198, _t241, 0x4828608);
										__eflags = _t253;
										if(_t253 != 0) {
											L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x4826e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x4828608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E04766B90(_t210,  &_v64);
										_t262 =  *0x4828608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E0476E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E047797C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E0477006A(0x4828608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x4828608);
												E0477B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x4826904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x4826e48; // 0x80b110
							_v72 = _t229;
							if(_t229 == 0) {
								L45:
								E0474FFB0(_t198, _t240, 0x4828608);
								_t253 = _v76;
								goto L29;
							}
							if( *((char*)(_t229 + 0x40)) != 0) {
								L13:
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E047700C2(0x4828608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
							_t18 = _t229 + 0x38; // 0x4
							if( *_t18 !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								goto L45;
							}
							goto L13;
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x047620a0
0x047620a8
0x047620ad
0x047620b3
0x047620b8
0x047620c2
0x047620c7
0x047620cb
0x047620d2
0x04762263
0x04762266
0x047a5836
0x047a5836
0x00000000
0x0476226c
0x0476226c
0x04762270
0x04762274
0x047620e2
0x047620e2
0x047620e6
0x047620ee
0x047a57dc
0x047a57de
0x047a57ec
0x047a57ec
0x047a57f1
0x047a57f3
0x047a57f8
0x00000000
0x047a57f8
0x047a57e0
0x047a57e4
0x047a57ea
0x00000000
0x00000000
0x00000000
0x047a57ea
0x047620f4
0x047620f4
0x047620f8
0x047620f8
0x047620fc
0x04762100
0x04762106
0x04762201
0x04762206
0x0476220b
0x0476220e
0x047622a9
0x047622ac
0x00000000
0x00000000
0x047622b2
0x047622b5
0x047a5801
0x047a5806
0x00000000
0x00000000
0x047a5810
0x047a5815
0x047a5818
0x00000000
0x00000000
0x047a581e
0x047622bb
0x047622bb
0x04762218
0x04762218
0x0476221c
0x04762220
0x04762222
0x047622c2
0x047622c4
0x047622dc
0x047622dc
0x047622e1
0x00000000
0x00000000
0x00000000
0x047622e7
0x047622c8
0x047622cd
0x047622d3
0x047622d6
0x047a5823
0x047a5825
0x047a5827
0x00000000
0x00000000
0x047a582d
0x00000000
0x047a582d
0x00000000
0x04762228
0x04762228
0x00000000
0x04762228
0x04762222
0x04762214
0x04762214
0x00000000
0x04762114
0x04762114
0x04762114
0x0476211a
0x0476211c
0x04762348
0x0476234d
0x047a5840
0x047a5845
0x047a5848
0x047a584e
0x047a584e
0x047a5848
0x04762353
0x04762355
0x04762388
0x04762388
0x04762368
0x0476236a
0x0476236c
0x0476238f
0x00000000
0x0476236e
0x0476236e
0x0476218e
0x0476218e
0x04762191
0x04762195
0x047a5a03
0x047a5a06
0x047a5a0c
0x047a5a0f
0x047a5a11
0x047a5a13
0x047a5a13
0x047a5a19
0x047a5a1f
0x00000000
0x0476219b
0x0476219b
0x047621a0
0x04762282
0x04762284
0x04762284
0x04762284
0x04762284
0x047621a6
0x047621a9
0x047621ac
0x047621ae
0x047621b3
0x0476228b
0x04762290
0x04762379
0x04762296
0x04762298
0x04762298
0x04762290
0x047621b9
0x047621be
0x047622a2
0x047622a2
0x047621c4
0x047621c8
0x047621cc
0x047621d0
0x047621d4
0x047621de
0x047621e3
0x047a5a29
0x047a5a2c
0x00000000
0x00000000
0x047a5a3b
0x00000000
0x047621e9
0x047621e9
0x047621e9
0x047621ee
0x047621f1
0x047a5a45
0x047a5a4b
0x047a5a52
0x047a5a58
0x047a5a5d
0x047a5a5f
0x047a5a71
0x047a5a61
0x047a5a6a
0x047a5a6a
0x047a5a76
0x047a5a79
0x047a5a7f
0x047a5a83
0x047a5a85
0x047a5a87
0x047a5a87
0x047a5a8c
0x047a5a91
0x047a5a97
0x047a5a9f
0x047a5aa0
0x047a5aa1
0x047a5aa6
0x047a5aab
0x047a5ab1
0x047a5ab3
0x047a5ab9
0x047a5aca
0x047a5ad4
0x047a5ad4
0x047a5ade
0x047a5ade
0x047a5aab
0x047a5a79
0x047a5a52
0x047621f7
0x047621f9
0x047621fe
0x047621fe
0x047621e3
0x04762195
0x0476236c
0x04762122
0x04762122
0x04762124
0x04762231
0x04762236
0x04762236
0x04762238
0x04762238
0x04762240
0x04762242
0x04762244
0x047a59fc
0x0476218c
0x0476218c
0x00000000
0x0476218c
0x0476224a
0x0476224f
0x04762256
0x04762304
0x04762309
0x0476230f
0x0476231e
0x0476231e
0x0476231e
0x04762320
0x04762325
0x0476232a
0x0476232c
0x0476233e
0x0476233e
0x00000000
0x0476232c
0x04762311
0x04762317
0x0476231a
0x0476231c
0x04762380
0x04762380
0x04762380
0x04762384
0x00000000
0x00000000
0x04762386
0x00000000
0x0476231c
0x0476225c
0x0476225c
0x00000000
0x0476225c
0x0476212a
0x04762134
0x04762138
0x0476213d
0x047a5858
0x047a5863
0x047a5863
0x047a5867
0x047a586a
0x00000000
0x00000000
0x047a586c
0x047a586c
0x047a5871
0x047a5875
0x047a5877
0x047a5997
0x047a599c
0x047a59a1
0x047a59a7
0x047a59a7
0x00000000
0x047a59a7
0x047a587d
0x00000000
0x047a588b
0x047a588b
0x047a5890
0x047a5892
0x047a5894
0x047a5899
0x047a589b
0x047a58a0
0x047a58a0
0x047a58aa
0x047a58b2
0x047a58b6
0x047a58be
0x047a58c6
0x047a58c9
0x047a590d
0x047a5917
0x047a591a
0x047a591c
0x047a5920
0x047a5928
0x047a592a
0x047a592c
0x047a592e
0x047a592e
0x047a58cb
0x047a58cd
0x047a58d8
0x047a58e0
0x047a58f4
0x047a58fe
0x047a58fe
0x047a593a
0x047a593e
0x047a5940
0x047a5942
0x00000000
0x047a5944
0x047a5944
0x047a5949
0x047a594e
0x047a594e
0x047a5953
0x047a595b
0x047a5976
0x047a5976
0x047a597a
0x047a597f
0x00000000
0x00000000
0x00000000
0x00000000
0x047a5981
0x047a5981
0x047a5981
0x047a5983
0x047a5988
0x047a598d
0x047a5991
0x047a5991
0x00000000
0x047a595d
0x047a595d
0x047a5963
0x047a5965
0x00000000
0x00000000
0x00000000
0x00000000
0x047a5967
0x047a5967
0x047a596b
0x047a596d
0x00000000
0x00000000
0x047a596f
0x047a5971
0x047a5971
0x047a5974
0x00000000
0x00000000
0x00000000
0x047a5974
0x00000000
0x047a5967
0x047a595b
0x047a5942
0x047a5863
0x04762143
0x04762143
0x04762149
0x0476214f
0x047622ec
0x047622f1
0x047622f6
0x00000000
0x047622f6
0x04762159
0x04762173
0x04762173
0x0476217d
0x04762181
0x04762186
0x047a59ae
0x047a59b2
0x047a59b5
0x047a59b7
0x047a59ba
0x047a59cd
0x047a59d1
0x047a59d5
0x047a59d9
0x047a59db
0x00000000
0x00000000
0x047a59dd
0x047a59dd
0x047a59e1
0x047a59e4
0x047a59e7
0x047a59ee
0x047a59ee
0x047a59f3
0x047a59f3
0x00000000
0x04762186
0x04762164
0x0476216d
0x00000000
0x00000000
0x00000000
0x0476216d
0x04762106
0x04762266
0x047620d8
0x047620da
0x047620e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb1403124e9d63cbea483b016eb2066d63fc1be83f92f650df6619d81c212d85
Instruction ID: 6b6d93249c0b52bfb790df665d8cdddd31ba95321e7524a79cdd64931ca2e3a9
Opcode Fuzzy Hash: fb1403124e9d63cbea483b016eb2066d63fc1be83f92f650df6619d81c212d85
Instruction Fuzzy Hash: 4DF1F231A08341AFEB65DF29C54476A77E2AFC5324F048A5DED969B381E734F841CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0474B090, Relevance: .4, Instructions: 405
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E0474B090(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t134;
				signed int _t139;
				signed char _t143;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int* _t150;
				signed int _t152;
				signed int _t161;
				signed char _t165;
				signed int _t167;
				signed int _t170;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t181;
				signed int _t182;
				signed int _t187;
				signed int _t190;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t199;
				signed int _t202;
				signed int _t208;
				signed int _t211;

				_t182 = _a16;
				_t178 = _a8;
				_t161 = _a4;
				 *_t182 = 0;
				 *(_t182 + 4) = 0;
				_t5 = _t161 + 4; // 0x4
				_t117 =  *_t5 & 0x00000001;
				if(_t178 == 0) {
					 *_t161 = _t182;
					 *(_t161 + 4) = _t182;
					if(_t117 != 0) {
						_t117 = _t182 | 0x00000001;
						 *(_t161 + 4) = _t117;
					}
					 *(_t182 + 8) = 0;
					goto L43;
				} else {
					_t208 = _t182 ^ _t178;
					_t192 = _t208;
					if(_t117 == 0) {
						_t192 = _t182;
					}
					_t117 = _a12 & 0x000000ff;
					 *(_t178 + _t117 * 4) = _t192;
					if(( *(_t161 + 4) & 0x00000001) == 0) {
						_t208 = _t178;
					}
					 *(_t182 + 8) = _t208 | 0x00000001;
					if(_a12 == 0) {
						_t14 = _t161 + 4; // 0x4
						_t177 =  *_t14;
						_t117 = _t177 & 0xfffffffe;
						if(_t178 == _t117) {
							_t117 = _a4;
							 *(_t117 + 4) = _t182;
							if((_t177 & 0x00000001) != 0) {
								_t161 = _a4;
								_t117 = _t182 | 0x00000001;
								 *(_t161 + 4) = _t117;
							} else {
								_t161 = _t117;
							}
						} else {
							_t161 = _a4;
						}
					}
					if(( *(_t178 + 8) & 0x00000001) == 0) {
						L42:
						L43:
						return _t117;
					} else {
						_t19 = _t161 + 4; // 0x4
						_t165 =  *_t19 & 0x00000001;
						do {
							_t211 =  *(_t178 + 8) & 0xfffffffc;
							if(_t165 != 0) {
								if(_t211 != 0) {
									_t211 = _t211 ^ _t178;
								}
							}
							_t119 =  *_t211;
							if(_t165 != 0) {
								if(_t119 != 0) {
									_t119 = _t119 ^ _t211;
								}
							}
							_t120 = 0;
							_t121 = _t120 & 0xffffff00 | _t119 != _t178;
							_v8 = _t121;
							_t122 = _t121 ^ 0x00000001;
							_v16 = _t122;
							_t123 =  *(_t211 + _t122 * 4);
							if(_t165 != 0) {
								if(_t123 == 0) {
									goto L20;
								}
								_t123 = _t123 ^ _t211;
								goto L13;
							} else {
								L13:
								if(_t123 == 0 || ( *(_t123 + 8) & 0x00000001) == 0) {
									L20:
									_t194 = _v16;
									if((_a12 & 0x000000ff) != _v8) {
										_t126 =  *(_t182 + 8) & 0xfffffffc;
										_t167 = _t165 & 1;
										_v12 = _t167;
										if(_t167 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t182;
											}
										}
										if(_t126 != _t178) {
											L83:
											_t178 = 0x1d;
											asm("int 0x29");
											goto L84;
										} else {
											_t126 =  *(_t178 + _t194 * 4);
											if(_t167 != 0) {
												if(_t126 != 0) {
													_t126 = _t126 ^ _t178;
												}
											}
											if(_t126 != _t182) {
												goto L83;
											} else {
												_t126 =  *(_t211 + _v8 * 4);
												if(_t167 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t211;
													}
												}
												if(_t126 != _t178) {
													goto L83;
												} else {
													_t77 = _t178 + 8; // 0x8
													_t150 = _t77;
													_v20 = _t150;
													_t126 =  *_t150 & 0xfffffffc;
													if(_t167 != 0) {
														if(_t126 != 0) {
															_t126 = _t126 ^ _t178;
														}
													}
													if(_t126 != _t211) {
														goto L83;
													} else {
														_t202 = _t211 ^ _t182;
														_t152 = _t202;
														if(_t167 == 0) {
															_t152 = _t182;
														}
														 *(_t211 + _v8 * 4) = _t152;
														_t170 = _v12;
														if(_t170 == 0) {
															_t202 = _t211;
														}
														 *(_t182 + 8) =  *(_t182 + 8) & 0x00000003 | _t202;
														_t126 =  *(_t182 + _v8 * 4);
														if(_t170 != 0) {
															if(_t126 == 0) {
																L58:
																if(_t170 != 0) {
																	if(_t126 != 0) {
																		_t126 = _t126 ^ _t178;
																	}
																}
																 *(_t178 + _v16 * 4) = _t126;
																_t199 = _t178 ^ _t182;
																if(_t170 != 0) {
																	_t178 = _t199;
																}
																 *(_t182 + _v8 * 4) = _t178;
																if(_t170 == 0) {
																	_t199 = _t182;
																}
																 *_v20 =  *_v20 & 0x00000003 | _t199;
																_t178 = _t182;
																_t167 =  *((intOrPtr*)(_a4 + 4));
																goto L21;
															}
															_t126 = _t126 ^ _t182;
														}
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t194 = _t167 & 0xfffffffc;
															if(_v12 != 0) {
																L84:
																if(_t194 != 0) {
																	_t194 = _t194 ^ _t126;
																}
															}
															if(_t194 != _t182) {
																goto L83;
															}
															if(_v12 != 0) {
																_t196 = _t126 ^ _t178;
															} else {
																_t196 = _t178;
															}
															 *(_t126 + 8) = _t167 & 0x00000003 | _t196;
															_t170 = _v12;
														}
														goto L58;
													}
												}
											}
										}
									}
									L21:
									_t182 = _v8 ^ 0x00000001;
									_t126 =  *(_t178 + 8) & 0xfffffffc;
									_v8 = _t182;
									_t194 = _t167 & 1;
									if(_t194 != 0) {
										if(_t126 != 0) {
											_t126 = _t126 ^ _t178;
										}
									}
									if(_t126 != _t211) {
										goto L83;
									} else {
										_t134 = _t182 ^ 0x00000001;
										_v16 = _t134;
										_t126 =  *(_t211 + _t134 * 4);
										if(_t194 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t211;
											}
										}
										if(_t126 != _t178) {
											goto L83;
										} else {
											_t167 = _t211 + 8;
											_t182 =  *_t167 & 0xfffffffc;
											_v20 = _t167;
											if(_t194 != 0) {
												if(_t182 == 0) {
													L80:
													_t126 = _a4;
													if( *_t126 != _t211) {
														goto L83;
													}
													 *_t126 = _t178;
													L34:
													if(_t194 != 0) {
														if(_t182 != 0) {
															_t182 = _t182 ^ _t178;
														}
													}
													 *(_t178 + 8) =  *(_t178 + 8) & 0x00000003 | _t182;
													_t139 =  *((intOrPtr*)(_t178 + _v8 * 4));
													if(_t194 != 0) {
														if(_t139 == 0) {
															goto L37;
														}
														_t126 = _t139 ^ _t178;
														goto L36;
													} else {
														L36:
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t182 = _t167 & 0xfffffffc;
															if(_t194 != 0) {
																if(_t182 != 0) {
																	_t182 = _t182 ^ _t126;
																}
															}
															if(_t182 != _t178) {
																goto L83;
															} else {
																if(_t194 != 0) {
																	_t190 = _t126 ^ _t211;
																} else {
																	_t190 = _t211;
																}
																 *(_t126 + 8) = _t167 & 0x00000003 | _t190;
																_t167 = _v20;
																goto L37;
															}
														}
														L37:
														if(_t194 != 0) {
															if(_t139 != 0) {
																_t139 = _t139 ^ _t211;
															}
														}
														 *(_t211 + _v16 * 4) = _t139;
														_t187 = _t211 ^ _t178;
														if(_t194 != 0) {
															_t211 = _t187;
														}
														 *(_t178 + _v8 * 4) = _t211;
														if(_t194 == 0) {
															_t187 = _t178;
														}
														_t143 =  *_t167 & 0x00000003 | _t187;
														 *_t167 = _t143;
														_t117 = _t143 | 0x00000001;
														 *_t167 = _t117;
														 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
														goto L42;
													}
												}
												_t182 = _t182 ^ _t211;
											}
											if(_t182 == 0) {
												goto L80;
											}
											_t144 =  *(_t182 + 4);
											if(_t194 != 0) {
												if(_t144 != 0) {
													_t144 = _t144 ^ _t182;
												}
											}
											if(_t144 == _t211) {
												if(_t194 != 0) {
													_t146 = _t182 ^ _t178;
												} else {
													_t146 = _t178;
												}
												 *(_t182 + 4) = _t146;
												goto L34;
											} else {
												_t126 =  *_t182;
												if(_t194 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t182;
													}
												}
												if(_t126 != _t211) {
													goto L83;
												} else {
													if(_t194 != 0) {
														_t148 = _t182 ^ _t178;
													} else {
														_t148 = _t178;
													}
													 *_t182 = _t148;
													goto L34;
												}
											}
										}
									}
								} else {
									 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
									_t182 = _t211;
									 *(_t123 + 8) =  *(_t123 + 8) & 0x000000fe;
									_t174 = _a4;
									_t117 =  *(_t211 + 8);
									_t181 = _t117 & 0xfffffffc;
									if(( *(_t174 + 4) & 0x00000001) != 0) {
										if(_t181 == 0) {
											goto L42;
										}
										_t178 = _t181 ^ _t211;
									}
									if(_t178 == 0) {
										goto L42;
									}
									goto L17;
								}
							}
							L17:
							 *(_t211 + 8) = _t117 | 0x00000001;
							_t40 = _t174 + 4; // 0x4
							_t117 =  *_t178;
							_t165 =  *_t40 & 0x00000001;
							if(_t165 != 0) {
								if(_t117 != 0) {
									_t117 = _t117 ^ _t178;
								}
							}
							_a12 = _t211 != _t117;
						} while (( *(_t178 + 8) & 0x00000001) != 0);
						goto L42;
					}
				}
			}

0x0474b095
0x0474b09b
0x0474b09f
0x0474b0a5
0x0474b0a7
0x0474b0aa
0x0474b0ad
0x0474b0b1
0x0474b3f8
0x0474b3fa
0x0474b3ff
0x0474b419
0x0474b41b
0x0474b41b
0x0474b401
0x00000000
0x0474b0b7
0x0474b0b9
0x0474b0bc
0x0474b0c0
0x0474b0c2
0x0474b0c2
0x0474b0c4
0x0474b0c8
0x0474b0cf
0x0474b0d1
0x0474b0d1
0x0474b0da
0x0474b0dd
0x0474b0df
0x0474b0df
0x0474b0e4
0x0474b0e9
0x0474b3e2
0x0474b3e5
0x0474b3eb
0x0479a676
0x0479a67b
0x0479a67d
0x0474b3f1
0x0474b3f1
0x0474b3f1
0x0474b0ef
0x0474b0ef
0x0474b0ef
0x0474b0e9
0x0474b0f6
0x0474b28d
0x0474b28e
0x0474b293
0x0474b0fc
0x0474b0fc
0x0474b101
0x0474b104
0x0474b107
0x0474b10c
0x0479a687
0x0479a68d
0x0479a68d
0x0479a687
0x0474b112
0x0474b116
0x0479a696
0x0479a69c
0x0479a69c
0x0479a696
0x0474b120
0x0474b121
0x0474b124
0x0474b127
0x0474b12a
0x0474b12d
0x0474b132
0x0479a6a5
0x00000000
0x00000000
0x0479a6ab
0x00000000
0x0474b138
0x0474b138
0x0474b13a
0x0474b193
0x0474b197
0x0474b19d
0x0474b29c
0x0474b29f
0x0474b2a2
0x0474b2a7
0x0479a6d2
0x0479a6d8
0x0479a6d8
0x0479a6d2
0x0474b2af
0x0474b420
0x0474b422
0x0474b423
0x00000000
0x0474b2b5
0x0474b2b5
0x0474b2ba
0x0479a6e1
0x0479a6e7
0x0479a6e7
0x0479a6e1
0x0474b2c2
0x00000000
0x0474b2c8
0x0474b2cb
0x0474b2d0
0x0479a6f0
0x0479a6f6
0x0479a6f6
0x0479a6f0
0x0474b2d8
0x00000000
0x0474b2de
0x0474b2de
0x0474b2de
0x0474b2e1
0x0474b2e6
0x0474b2eb
0x0479a6ff
0x0479a705
0x0479a705
0x0479a6ff
0x0474b2f3
0x00000000
0x0474b2f9
0x0474b2fb
0x0474b2fd
0x0474b301
0x0474b303
0x0474b303
0x0474b308
0x0474b30b
0x0474b310
0x0474b312
0x0474b312
0x0474b31c
0x0474b322
0x0474b327
0x0479a70e
0x0474b335
0x0474b337
0x0479a71d
0x0479a723
0x0479a723
0x0479a71d
0x0474b340
0x0474b345
0x0474b349
0x0479a72a
0x0479a72a
0x0474b352
0x0474b357
0x0474b359
0x0474b359
0x0474b365
0x0474b367
0x0474b36c
0x00000000
0x0474b36c
0x0479a714
0x0479a714
0x0474b32f
0x0474b3b8
0x0474b3bd
0x0474b3c4
0x0474b425
0x0474b427
0x0474b429
0x0474b429
0x0474b427
0x0474b3c8
0x00000000
0x00000000
0x0474b3ce
0x0474b42f
0x0474b3d0
0x0474b3d0
0x0474b3d0
0x0474b3d7
0x0474b3da
0x0474b3da
0x00000000
0x0474b32f
0x0474b2f3
0x0474b2d8
0x0474b2c2
0x0474b2af
0x0474b1a3
0x0474b1a9
0x0474b1af
0x0474b1b2
0x0474b1b5
0x0474b1b8
0x0479a733
0x0479a739
0x0479a739
0x0479a733
0x0474b1c0
0x00000000
0x0474b1c6
0x0474b1c8
0x0474b1cb
0x0474b1ce
0x0474b1d3
0x0479a742
0x0479a748
0x0479a748
0x0479a742
0x0474b1db
0x00000000
0x0474b1e1
0x0474b1e1
0x0474b1e6
0x0474b1e9
0x0474b1ee
0x0479a751
0x0474b409
0x0474b409
0x0474b40e
0x00000000
0x00000000
0x0474b410
0x0474b22d
0x0474b22f
0x0479a790
0x0479a796
0x0479a796
0x0479a790
0x0474b23d
0x0474b243
0x0474b248
0x0479a79f
0x00000000
0x00000000
0x0479a7a5
0x00000000
0x0474b24e
0x0474b24e
0x0474b250
0x0474b374
0x0474b379
0x0474b37e
0x0479a7ae
0x0479a7b4
0x0479a7b4
0x0479a7ae
0x0474b386
0x00000000
0x0474b38c
0x0474b38e
0x0479a7bd
0x0474b394
0x0474b394
0x0474b394
0x0474b39b
0x0474b39e
0x00000000
0x0474b39e
0x0474b386
0x0474b256
0x0474b258
0x0479a7c6
0x0479a7cc
0x0479a7cc
0x0479a7c6
0x0474b261
0x0474b266
0x0474b26a
0x0479a7d3
0x0479a7d3
0x0474b273
0x0474b278
0x0474b27a
0x0474b27a
0x0474b281
0x0474b283
0x0474b285
0x0474b287
0x0474b289
0x00000000
0x0474b289
0x0474b248
0x0479a757
0x0479a757
0x0474b1f6
0x00000000
0x00000000
0x0474b1fc
0x0474b201
0x0479a760
0x0479a766
0x0479a766
0x0479a760
0x0474b209
0x0474b3a8
0x0479a76f
0x0474b3ae
0x0474b3ae
0x0474b3ae
0x0474b3b0
0x00000000
0x0474b20f
0x0474b20f
0x0474b213
0x0479a778
0x0479a77e
0x0479a77e
0x0479a778
0x0474b21b
0x00000000
0x0474b221
0x0474b223
0x0479a787
0x0474b229
0x0474b229
0x0474b229
0x0474b22b
0x00000000
0x0474b22b
0x0474b21b
0x0474b209
0x0474b1db
0x0474b142
0x0474b142
0x0474b146
0x0474b148
0x0474b14c
0x0474b14f
0x0474b154
0x0474b15b
0x0479a6b4
0x00000000
0x00000000
0x0479a6ba
0x0479a6ba
0x0474b163
0x00000000
0x00000000
0x00000000
0x0474b163
0x0474b13a
0x0474b169
0x0474b16b
0x0474b16e
0x0474b171
0x0474b175
0x0474b178
0x0479a6c3
0x0479a6c9
0x0479a6c9
0x0479a6c3
0x0474b180
0x0474b184
0x00000000
0x0474b104
0x0474b0f6

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: 075b9397b668fa34d3dd91404bdb78c8210dc640f01bf66334a8b875648d89f2
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: B1D1ED31B052568BCF25CE6ACA8027ABBE5AFC5354B288568DC65CB385E731FC41E790

Uniqueness

Uniqueness Score: -1.00%

Function 04730D20, Relevance: .4, Instructions: 372
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E04730D20(signed short* _a4, signed char _a8, unsigned int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				signed char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				unsigned int _v100;
				signed int _t159;
				unsigned int _t160;
				signed int _t162;
				unsigned int _t163;
				signed int _t180;
				signed int _t192;
				signed int _t193;
				unsigned int _t194;
				signed char _t196;
				signed int _t197;
				signed char _t198;
				signed char _t199;
				unsigned int _t200;
				unsigned int _t202;
				unsigned int _t204;
				unsigned int _t205;
				unsigned int _t209;
				signed int _t210;
				signed int _t211;
				unsigned int _t212;
				signed char _t213;
				signed short* _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				unsigned int _t218;
				signed int _t220;
				signed int _t221;
				signed short _t223;
				signed char _t224;
				signed int _t229;
				signed int _t231;
				unsigned int _t233;
				unsigned int _t237;
				signed int _t238;
				unsigned int _t239;
				signed int _t240;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				unsigned int _t258;
				void* _t261;

				_t213 = _a8;
				_t159 = 0;
				_v60 = 0;
				_t237 = _t213 >> 1;
				_t210 = 0;
				_t257 = 0;
				_v56 = 0;
				_v52 = 0;
				_v44 = 0;
				_v48 = 0;
				_v92 = 0;
				_v88 = 0;
				_v76 = 0;
				_v72 = 0;
				_v64 = 0;
				_v68 = 0;
				_v24 = 0;
				_v80 = 0;
				_v84 = 0;
				_v28 = 0;
				_v32 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_v100 = _t237;
				if(_t237 > 0x100) {
					_t254 = 0x100;
					_v36 = 0x100;
					L2:
					_t261 = _t213 - 2;
					if(_t261 == 0) {
						_t214 = _a4;
						_t160 =  *_t214 & 0x0000ffff;
						__eflags = _t160;
						if(_t160 == 0) {
							L108:
							_t159 = 0;
							L8:
							_t238 = 0;
							_v96 = 0;
							if(_t254 == 0) {
								L30:
								_v24 = _t159 - 1;
								goto L31;
							} else {
								goto L11;
								L13:
								_t224 = _t223 >> 8;
								_v40 = _t224;
								_t256 = _t224 & 0x000000ff;
								_t196 = _a4[_t238];
								_v5 = _t196;
								_t197 = _t196 & 0x000000ff;
								if(_t197 == 0xd) {
									__eflags = _t257 - 0xa;
									if(_t257 == 0xa) {
										_v12 = _v12 + 1;
									}
								} else {
									if(_t197 == 0xa) {
										__eflags = _t257 - 0xd;
										if(_t257 == 0xd) {
											_v12 = _v12 + 1;
										}
									}
								}
								_v24 = (0 | _t256 == 0x00000000) + _v24 + (0 | _t197 == 0x00000000);
								if(_t256 > _t257) {
									_t229 = _t256;
								} else {
									_t229 = _t257;
								}
								if(_t257 >= _t256) {
									_t257 = _t256;
								}
								_v28 = _v28 + _t229 - _t257;
								_t231 = _t197;
								if(_t197 <= _t210) {
									_t231 = _t210;
								}
								if(_t210 >= _t197) {
									_t210 = _t197;
								}
								_v32 = _v32 + _t231 - _t210;
								_t238 = _v96 + 1;
								_t210 = _t197;
								_t257 = _t256;
								_v96 = _t238;
								if(_t238 < _v36) {
									_t214 = _a4;
									L11:
									_t223 = _t214[_t238] & 0x0000ffff;
									_t193 = _t223 & 0x0000ffff;
									if(_t193 >= 0x900 || _t193 < 0x21) {
										goto L58;
									} else {
										goto L13;
									}
								}
								_t198 = _v5;
								if(_t198 == 0xd) {
									_t199 = _v40;
									__eflags = _t199 - 0xa;
									if(_t199 != 0xa) {
										L27:
										_t233 = _v12;
										L28:
										if(_t199 != 0) {
											__eflags = _t199 - 0x1a;
											if(_t199 == 0x1a) {
												_v12 = _t233 + 1;
											}
											L31:
											_t162 = _a8;
											if(_t162 > 0x200) {
												_t255 = 0x200;
											} else {
												_t255 = _t162;
											}
											_t215 =  *0x4826d59; // 0x0
											if(_t215 != 0) {
												_t239 = 0;
												__eflags = _t255;
												if(_t255 == 0) {
													goto L34;
												} else {
													goto L119;
												}
												do {
													L119:
													_t192 =  *(_a4 + _t239) & 0x000000ff;
													__eflags =  *((short*)(0x4826920 + _t192 * 2));
													_t163 = _v20;
													if( *((short*)(0x4826920 + _t192 * 2)) != 0) {
														_t163 = _t163 + 1;
														_t239 = _t239 + 1;
														__eflags = _t239;
														_v20 = _t163;
													}
													_t239 = _t239 + 1;
													__eflags = _t239 - _t255;
												} while (_t239 < _t255);
												goto L35;
											} else {
												L34:
												_t163 = 0;
												L35:
												_t240 = _v32;
												_t211 = _v28;
												if(_t240 < 0x7f) {
													__eflags = _t211;
													if(_t211 != 0) {
														L37:
														if(_t240 == 0) {
															_v16 = 0x10;
														}
														L38:
														_t258 = _a12;
														if(_t215 != 0) {
															__eflags = _t163;
															if(_t163 == 0) {
																goto L39;
															}
															__eflags = _t258;
															if(_t258 == 0) {
																goto L39;
															}
															__eflags =  *_t258 & 0x00000400;
															if(( *_t258 & 0x00000400) == 0) {
																goto L39;
															}
															_t218 = _v100;
															__eflags = _t218 - 0x100;
															if(_t218 > 0x100) {
																_t218 = 0x100;
															}
															_t220 = (_t218 >> 1) - 1;
															__eflags = _v20 - 0xaaaaaaab * _t220 >> 0x20 >> 1;
															if(_v20 >= 0xaaaaaaab * _t220 >> 0x20 >> 1) {
																_t221 = _t220 + _t220;
																__eflags = _v20 - 0xaaaaaaab * _t221 >> 0x20 >> 1;
																asm("sbb ecx, ecx");
																_t216 =  ~_t221 + 1;
																__eflags = _t216;
															} else {
																_t216 = 3;
															}
															_v16 = _v16 | 0x00000400;
															_t240 = _v32;
															L40:
															if(_t211 * _t216 < _t240) {
																_v16 = _v16 | 0x00000002;
															}
															_t217 = _v16;
															if(_t240 * _t216 < _t211) {
																_t217 = _t217 | 0x00000020;
															}
															if(_v44 + _v48 + _v52 + _v56 + _v60 != 0) {
																_t217 = _t217 | 0x00000004;
															}
															if(_v64 + _v68 + _v72 + _v76 != 0) {
																_t217 = _t217 | 0x00000040;
															}
															if(_v80 + _v84 + _v88 + _v92 == 0) {
																_t212 = _v12;
																__eflags = _t212;
																if(_t212 == 0) {
																	goto L48;
																}
																__eflags = _t212 - 0xcccccccd * _t255 >> 0x20 >> 5;
																if(_t212 >= 0xcccccccd * _t255 >> 0x20 >> 5) {
																	goto L47;
																}
																goto L48;
															} else {
																L47:
																_t217 = _t217 | 0x00000100;
																L48:
																if((_a8 & 0x00000001) != 0) {
																	_t217 = _t217 | 0x00000200;
																}
																if(_v24 != 0) {
																	_t217 = _t217 | 0x00001000;
																}
																_t180 =  *_a4 & 0x0000ffff;
																if(_t180 != 0xfeff) {
																	__eflags = _t180 - 0xfffe;
																	if(_t180 == 0xfffe) {
																		_t217 = _t217 | 0x00000080;
																	}
																} else {
																	_t217 = _t217 | 0x00000008;
																}
																if(_t258 != 0) {
																	 *_t258 =  *_t258 & _t217;
																	_t217 =  *_t258;
																}
																if((_t217 & 0x00000b08) != 8) {
																	__eflags = _t217 & 0x000000f0;
																	if((_t217 & 0x000000f0) != 0) {
																		L84:
																		return 0;
																	}
																	__eflags = _t217 & 0x00000f00;
																	if((_t217 & 0x00000f00) == 0) {
																		__eflags = _t217 & 0x0000f00f;
																		if((_t217 & 0x0000f00f) == 0) {
																			goto L84;
																		}
																		goto L56;
																	}
																	goto L84;
																} else {
																	L56:
																	return 1;
																}
															}
														}
														L39:
														_t216 = 3;
														goto L40;
													}
													_v16 = 1;
													goto L38;
												}
												if(_t211 == 0) {
													goto L38;
												}
												goto L37;
											}
										} else {
											_t159 = _v24;
											goto L30;
										}
									}
									L104:
									_t233 = _v12 + 1;
									_v12 = _t233;
									goto L28;
								}
								_t199 = _v40;
								if(_t198 != 0xa || _t199 != 0xd) {
									goto L27;
								} else {
									goto L104;
								}
								L58:
								__eflags = _t193 - 0x3001;
								if(_t193 < 0x3001) {
									L60:
									__eflags = _t193 - 0xd00;
									if(__eflags > 0) {
										__eflags = _t193 - 0x3000;
										if(__eflags > 0) {
											_t194 = _t193 - 0xfeff;
											__eflags = _t194;
											if(_t194 != 0) {
												_t200 = _t194 - 0xff;
												__eflags = _t200;
												if(_t200 == 0) {
													_v88 = _v88 + 1;
												} else {
													__eflags = _t200 == 1;
													if(_t200 == 1) {
														_v92 = _v92 + 1;
													}
												}
											}
										} else {
											if(__eflags == 0) {
												_v48 = _v48 + 1;
											} else {
												_t202 = _t193 - 0x2000;
												__eflags = _t202;
												if(_t202 == 0) {
													_v68 = _v68 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v76 = _v76 + 1;
										goto L13;
									}
									__eflags = _t193 - 0x20;
									if(__eflags > 0) {
										_t204 = _t193 - 0x900;
										__eflags = _t204;
										if(_t204 == 0) {
											_v64 = _v64 + 1;
										} else {
											_t205 = _t204 - 0x100;
											__eflags = _t205;
											if(_t205 == 0) {
												_v72 = _v72 + 1;
											} else {
												__eflags = _t205 == 0xd;
												if(_t205 == 0xd) {
													_v84 = _v84 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v44 = _v44 + 1;
										goto L13;
									}
									__eflags = _t193 - 0xd;
									if(_t193 > 0xd) {
										goto L13;
									}
									_t84 = _t193 + 0x4731174; // 0x4040400
									switch( *((intOrPtr*)(( *_t84 & 0x000000ff) * 4 +  &M04731160))) {
										case 0:
											_v80 = _v80 + 1;
											goto L13;
										case 1:
											_v52 = _v52 + 1;
											goto L13;
										case 2:
											_v56 = _v56 + 1;
											goto L13;
										case 3:
											_v60 = _v60 + 1;
											goto L13;
										case 4:
											goto L13;
									}
								}
								__eflags = _t193 - 0xfeff;
								if(_t193 < 0xfeff) {
									goto L13;
								}
								goto L60;
							}
						}
						__eflags = _t160 >> 8;
						if(_t160 >> 8 == 0) {
							L101:
							_t209 = _a12;
							__eflags = _t209;
							if(_t209 != 0) {
								 *_t209 = 5;
							}
							goto L84;
						}
						goto L108;
					}
					if(_t261 <= 0 || _t237 > 0x100) {
						_t214 = _a4;
					} else {
						_t214 = _a4;
						if((_t213 & 0x00000001) == 0 && ( *(_t214 + _t254 * 2 - 2) & 0x0000ff00) == 0) {
							_t254 = _t254 - 1;
							_v36 = _t254;
						}
					}
					goto L8;
				}
				_t254 = _t237;
				_v36 = _t254;
				if(_t254 == 0) {
					goto L101;
				}
				goto L2;
			}

0x04730d2b
0x04730d2e
0x04730d32
0x04730d39
0x04730d3b
0x04730d3d
0x04730d3f
0x04730d46
0x04730d4d
0x04730d54
0x04730d5b
0x04730d62
0x04730d69
0x04730d70
0x04730d77
0x04730d7e
0x04730d85
0x04730d88
0x04730d8b
0x04730d8e
0x04730d91
0x04730d94
0x04730d97
0x04730d9a
0x04730d9d
0x04730da6
0x047310e9
0x047310ee
0x04730db9
0x04730db9
0x04730dbc
0x0478e9c7
0x0478e9ca
0x0478e9cd
0x0478e9d0
0x0478e9dd
0x0478e9dd
0x04730dec
0x04730dec
0x04730dee
0x04730df3
0x04730ebf
0x04730ec0
0x00000000
0x04730df9
0x04730df9
0x04730e1e
0x04730e21
0x04730e24
0x04730e27
0x04730e2a
0x04730e2d
0x04730e30
0x04730e36
0x04731040
0x04731043
0x04731049
0x04731049
0x04730e3c
0x04730e3f
0x04731007
0x0473100a
0x04731010
0x04731010
0x0473100a
0x04730e3f
0x04730e58
0x04730e5d
0x04731000
0x04730e63
0x04730e63
0x04730e63
0x04730e67
0x04730e69
0x04730e69
0x04730e6d
0x04730e70
0x04730e74
0x04730e76
0x04730e76
0x04730e7a
0x04730e7c
0x04730e7c
0x04730e83
0x04730e86
0x04730e87
0x04730e89
0x04730e8b
0x04730e91
0x04730e00
0x04730e03
0x04730e03
0x04730e07
0x04730e0f
0x00000000
0x00000000
0x00000000
0x00000000
0x04730e0f
0x04730e97
0x04730e9c
0x0473113e
0x04731141
0x04731143
0x04730eb1
0x04730eb1
0x04730eb4
0x04730eb6
0x04731110
0x04731112
0x0478ea25
0x0478ea25
0x04730ec3
0x04730ec3
0x04730ecb
0x047310fe
0x04730ed1
0x04730ed1
0x04730ed1
0x04730ed3
0x04730edb
0x0478ea2d
0x0478ea2f
0x0478ea31
0x00000000
0x00000000
0x00000000
0x00000000
0x0478ea37
0x0478ea37
0x0478ea3a
0x0478ea3e
0x0478ea47
0x0478ea4a
0x0478ea4c
0x0478ea4d
0x0478ea4d
0x0478ea4e
0x0478ea4e
0x0478ea51
0x0478ea52
0x0478ea52
0x00000000
0x04730ee1
0x04730ee1
0x04730ee1
0x04730ee3
0x04730ee3
0x04730ee6
0x04730eec
0x0478ea5b
0x0478ea5d
0x04730ef6
0x04730ef8
0x0478ea6f
0x0478ea6f
0x04730efe
0x04730efe
0x04730f03
0x0478ea7b
0x0478ea7d
0x00000000
0x00000000
0x0478ea83
0x0478ea85
0x00000000
0x00000000
0x0478ea8b
0x0478ea91
0x00000000
0x00000000
0x0478ea97
0x0478ea9a
0x0478eaa0
0x0478eaa2
0x0478eaa2
0x0478eaae
0x0478eab3
0x0478eab6
0x0478eabf
0x0478eaca
0x0478eacd
0x0478ead1
0x0478ead1
0x0478eab8
0x0478eab8
0x0478eab8
0x0478ead2
0x0478ead9
0x04730f0e
0x04730f15
0x04730f17
0x04730f17
0x04730f1e
0x04730f23
0x0478eae1
0x0478eae1
0x04730f38
0x04730f3a
0x04730f3a
0x04730f49
0x04731108
0x04731108
0x04730f5b
0x047310c7
0x047310ca
0x047310cc
0x00000000
0x00000000
0x047310dc
0x047310de
0x00000000
0x00000000
0x00000000
0x04730f61
0x04730f61
0x04730f61
0x04730f67
0x04730f6b
0x0473111d
0x0473111d
0x04730f75
0x04730f77
0x04730f77
0x04730f85
0x04730f8b
0x047310b9
0x047310bc
0x0478eae9
0x0478eae9
0x04730f91
0x04730f91
0x04730f91
0x04730f96
0x04730f98
0x04730f9a
0x04730f9a
0x04730fa6
0x0473107c
0x0473107f
0x0473108d
0x00000000
0x0473108d
0x04731081
0x04731087
0x0478eaf4
0x0478eafa
0x00000000
0x00000000
0x00000000
0x0478eb00
0x00000000
0x04730fac
0x04730fac
0x00000000
0x04730fac
0x04730fa6
0x04730f5b
0x04730f09
0x04730f09
0x00000000
0x04730f09
0x0478ea63
0x00000000
0x0478ea63
0x04730ef4
0x00000000
0x00000000
0x00000000
0x04730ef4
0x04730ebc
0x04730ebc
0x00000000
0x04730ebc
0x04730eb6
0x04731149
0x0473114c
0x0473114d
0x00000000
0x0473114d
0x04730ea4
0x04730ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x04730fb7
0x04730fb7
0x04730fbc
0x04730fc9
0x04730fc9
0x04730fce
0x04731020
0x04731025
0x04731094
0x04731094
0x04731099
0x0478ea04
0x0478ea04
0x0478ea09
0x0478ea1c
0x0478ea0b
0x0478ea0b
0x0478ea0e
0x0478ea14
0x0478ea14
0x0478ea0e
0x0478ea09
0x04731027
0x04731027
0x04731155
0x0473102d
0x0473102d
0x0473102d
0x04731032
0x0478e9fc
0x0478e9fc
0x04731032
0x04731027
0x00000000
0x04731025
0x04730fd0
0x0478e9f4
0x00000000
0x0478e9f4
0x04730fd6
0x04730fd9
0x04731059
0x04731059
0x0473105e
0x0478e9ec
0x04731064
0x04731064
0x04731064
0x04731069
0x047310ac
0x0473106b
0x0473106b
0x0473106e
0x04731074
0x04731074
0x0473106e
0x04731069
0x00000000
0x0473105e
0x04730fdb
0x047310a4
0x00000000
0x047310a4
0x04730fe1
0x04730fe4
0x00000000
0x00000000
0x04730fea
0x04730ff1
0x00000000
0x04730ff8
0x00000000
0x00000000
0x0478e9e4
0x00000000
0x00000000
0x04731018
0x00000000
0x00000000
0x04731051
0x00000000
0x00000000
0x00000000
0x00000000
0x04730ff1
0x04730fbe
0x04730fc3
0x00000000
0x00000000
0x00000000
0x04730fc3
0x04730df3
0x0478e9d5
0x0478e9d7
0x04731128
0x04731128
0x0473112b
0x0473112d
0x04731133
0x04731133
0x00000000
0x0473112d
0x00000000
0x0478e9d7
0x04730dc2
0x047310f6
0x04730dd4
0x04730dd7
0x04730dda
0x04730de8
0x04730de9
0x04730de9
0x04730dda
0x00000000
0x04730dc2
0x04730dac
0x04730dae
0x04730db3
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc98a316607da3726a7f08463b72161a044d79583572cbcd8a504897a9ca1af8
Instruction ID: f84329641b4438be90a243cbb67ea1a0314ee3165cd805c5f39d996c9d953248
Opcode Fuzzy Hash: cc98a316607da3726a7f08463b72161a044d79583572cbcd8a504897a9ca1af8
Instruction Fuzzy Hash: 26D1AE31F442998BDB289FA9C5943FDBBB1EB44302F548429E442E738BE774B981CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0474D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E0474D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				intOrPtr _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				intOrPtr _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				intOrPtr _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x482d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E04746600(0x48252d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x4827b9c; // 0x0
							_t281 = L04754620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E0477F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x4827b90; // 0x775e0000
								if(_t384 == 0) {
									_t353 =  *0x4827b8c; // 0x802b50
									_v176 = _t353;
									_t63 = _t353 + 0x50; // 0x802c00
									_t64 =  *_t63 + 0x20; // 0x9
									_t320 =  *_t64;
									_v184 = _t320;
								} else {
									E04752280(_t200, 0x48284d8);
									_t277 =  *0x48285f4; // 0x803ea8
									_t351 =  *0x48285f8 & 1;
									while(_t277 != 0) {
										_t21 = _t277 - 0x50; // 0x74c80000
										_t337 =  *_t21;
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t23 = _t277 - 0x18; // 0x803ef0
													_t340 =  *_t23;
													_t24 = _t277 - 0x68; // 0x803e40
													_t353 = _t24;
													_v176 = _t353;
													__eflags =  *((intOrPtr*)(_t340 + 0xc)) - 0xffffffff;
													if( *((intOrPtr*)(_t340 + 0xc)) != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t30 = _t353 + 0x50; // 0x803ef0
															_t340 =  *_t30;
														}
													}
													_t31 = _t340 + 0x20; // 0x9
													_v184 =  *_t31;
												}
											} else {
												_t22 = _t277 + 4; // 0x804ee8
												_t339 =  *_t22;
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E0474FFB0(_t287, _t353, 0x48284d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E0478CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E04746600(0x48252d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E04747926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x482b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E047BE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x4828472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x482b218; // 0x0
														asm("ror edi, cl");
														 *0x482b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E04752280(_t250, 0x48284d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L04773898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E0474FFB0(_t293, _t353, 0x48284d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E047737F5(_t353, 0);
																}
																E04770413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E04769B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E047602D6(_t174);
																}
																L047577F0( *0x4827b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E0476C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L0474EC7F(_t353);
										L047619B8(_t287, 0, _t353, 0);
										_t200 = E0473F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E0477B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x482b2f8; // 0x1300000
									if((_t206 |  *0x482b2fc) == 0 || ( *0x482b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x482b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E047E6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E047E6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E0474E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L0474EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E04779730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E0474E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L04748F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E04773C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x0474d5f2
0x0474d5f5
0x0474d5f5
0x0474d5fd
0x0474d600
0x0474d60a
0x0474d60d
0x0474d617
0x0474d61d
0x0474d627
0x0474d62e
0x0474d911
0x0474d913
0x00000000
0x0474d919
0x0474d919
0x0474d919
0x0474d634
0x0474d634
0x0474d634
0x0474d634
0x0474d640
0x0474d8bf
0x00000000
0x0474d646
0x0474d646
0x0474d64d
0x0474d652
0x0479b2fc
0x0479b2fc
0x0479b302
0x0479b33b
0x0479b341
0x00000000
0x0479b304
0x0479b304
0x0479b319
0x0479b31e
0x0479b324
0x0479b326
0x0479b332
0x0479b347
0x0479b34c
0x0479b351
0x0479b35a
0x00000000
0x0479b328
0x0479b328
0x00000000
0x0479b328
0x0479b326
0x0474d658
0x0474d658
0x0474d65b
0x0474d665
0x00000000
0x0474d66b
0x0474d66b
0x0474d66b
0x0474d66b
0x0474d66d
0x0474d672
0x0474d67a
0x00000000
0x00000000
0x0474d680
0x0474d686
0x0474d8ce
0x0474d8d4
0x0474d8da
0x0474d8dd
0x0474d8dd
0x0474d8e0
0x0474d68c
0x0474d691
0x0474d69d
0x0474d6a2
0x0474d6a7
0x0474d6b0
0x0474d6b0
0x0474d6b5
0x0474d6e0
0x0474d6b7
0x0474d6b7
0x0474d6b9
0x0474d6b9
0x0474d6bb
0x0474d6bd
0x0474d6ce
0x0474d6d0
0x0474d6d2
0x0479b363
0x0479b365
0x00000000
0x0479b36b
0x00000000
0x0479b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0474d6bf
0x0474d6bf
0x0474d6e5
0x0474d6e7
0x0474d6e9
0x0474d6e9
0x0474d6ec
0x0474d6ec
0x0474d6ef
0x0474d6f5
0x0474d6f9
0x0474d6fb
0x0474d6fd
0x0474d701
0x0474d703
0x0474d70a
0x0474d70a
0x0474d70a
0x0474d701
0x0474d70d
0x0474d710
0x0474d710
0x0474d6c1
0x0474d6c1
0x0474d6c1
0x0474d6c6
0x0479b36d
0x0479b36f
0x00000000
0x0479b375
0x0479b375
0x0479b375
0x00000000
0x0479b375
0x00000000
0x0474d6cc
0x0474d6d8
0x0474d6d8
0x0474d6d8
0x00000000
0x0474d6c6
0x0474d6bf
0x00000000
0x0474d6da
0x0474d6da
0x0474d716
0x0474d71b
0x0474d720
0x0474d726
0x0474d726
0x0474d72d
0x00000000
0x0474d733
0x0474d739
0x0474d742
0x0474d750
0x0474d758
0x0474d764
0x0474d776
0x0474d77a
0x0474d783
0x0474d928
0x0474d92c
0x0474d93d
0x0474d944
0x0474d94f
0x0474d954
0x0474d956
0x0474d95f
0x0474d961
0x0474d973
0x0474d973
0x0474d956
0x0474d944
0x0474d92c
0x0474d78b
0x0479b394
0x0474d791
0x0474d798
0x0479b3a3
0x0479b3bb
0x0479b3bb
0x0474d7a5
0x0474d866
0x0474d870
0x0474d884
0x0474d892
0x0474d898
0x0474d89e
0x0474d8a0
0x0474d8a6
0x0474d8ac
0x0474d8ae
0x0474d8b4
0x0474d8b4
0x0474d8ae
0x0474d7a5
0x0474d78b
0x0474d7b1
0x0479b3c5
0x0479b3c5
0x0474d7c3
0x0474d7ca
0x0474d7e5
0x0474d7eb
0x0474d8eb
0x0474d8ed
0x00000000
0x0474d8f3
0x0474d8f3
0x0474d8f3
0x00000000
0x0474d8ed
0x0474d7cc
0x0474d7cc
0x0474d7d2
0x00000000
0x0474d7d4
0x0474d7d4
0x0474d7d7
0x0474d7df
0x0479b3d4
0x0479b3d9
0x0479b3dc
0x0479b3dc
0x0479b3df
0x0479b3e2
0x0479b468
0x0479b46d
0x0479b46f
0x0479b46f
0x0479b475
0x0474d8f8
0x0474d8f9
0x0474d8fd
0x0479b3e8
0x0479b3e8
0x0479b3eb
0x0479b3ed
0x00000000
0x0479b3ef
0x0479b3ef
0x0479b3f1
0x0479b3f4
0x0479b3fe
0x0479b404
0x0479b409
0x0479b40e
0x0479b410
0x0479b410
0x0479b414
0x0479b414
0x0479b41b
0x0479b420
0x0479b423
0x0479b425
0x0479b427
0x0479b42a
0x0479b42d
0x0479b42d
0x0479b42a
0x0479b432
0x0479b436
0x0479b438
0x0479b43b
0x0479b43b
0x0479b449
0x0479b44e
0x0479b454
0x0479b458
0x0479b458
0x0479b45d
0x00000000
0x0479b45d
0x0479b3ed
0x00000000
0x00000000
0x00000000
0x0474d7df
0x0474d7d2
0x0474d7ca
0x0479b37c
0x0479b37e
0x0479b385
0x0479b38a
0x00000000
0x0479b38a
0x0474d742
0x0474d7f1
0x0474d7f8
0x0479b49b
0x0479b49b
0x0474d800
0x0474d837
0x0474d843
0x0474d845
0x0474d847
0x0474d84a
0x0474d84b
0x0474d84e
0x0474d857
0x0474d802
0x0474d802
0x0474d80d
0x00000000
0x0474d818
0x0474d818
0x0474d824
0x0474d831
0x0479b4a5
0x0479b4ab
0x0479b4b3
0x0479b4b8
0x0479b4bb
0x00000000
0x0479b4c1
0x0479b4c1
0x0479b4c8
0x00000000
0x0479b4ce
0x0479b4d4
0x0479b4e1
0x0479b4e3
0x0479b4e5
0x00000000
0x0479b4eb
0x0479b4f0
0x0479b4f2
0x0474dac9
0x0474dacc
0x0474dacf
0x0474dad1
0x0474dd78
0x0474dd78
0x0474dcf2
0x00000000
0x0474dad7
0x0474dad9
0x0474dadb
0x00000000
0x00000000
0x0474dae1
0x0474dae1
0x0474dae4
0x0474dae6
0x0479b4f9
0x0479b4f9
0x0479b500
0x0474daec
0x0474daec
0x0474daf5
0x0474daf8
0x0474dafb
0x0474db03
0x0474db11
0x0474db16
0x0474db19
0x0474db1b
0x0479b52c
0x0479b531
0x0479b534
0x0474db21
0x0474db21
0x0474db24
0x0474dcd9
0x0474dce2
0x0474dce5
0x0474dd6a
0x0474dd6d
0x00000000
0x0474dd73
0x0479b51a
0x0479b51c
0x0479b51f
0x0479b524
0x00000000
0x0479b524
0x0474dce7
0x0474dce7
0x0474dce7
0x00000000
0x0474dce7
0x00000000
0x0474db2a
0x0474db2c
0x0474db31
0x0474db33
0x0474db36
0x0474db39
0x0474db3b
0x0474db66
0x0474db66
0x0474db3d
0x0474db3d
0x0474db3e
0x0474db46
0x0474db47
0x0474db49
0x0474db4c
0x0474db53
0x0474db55
0x0474db58
0x0474db5a
0x0479b50a
0x0479b50f
0x0479b512
0x0474db60
0x0474db60
0x0474db63
0x0474db63
0x00000000
0x0474db63
0x0474db5a
0x0474db3b
0x0474db24
0x0474db69
0x0474db69
0x0474db6c
0x0474db6f
0x0474db74
0x0479b557
0x0479b557
0x0479b55e
0x0474db7a
0x0474db7c
0x0474db7f
0x0474db82
0x0474db85
0x00000000
0x0474db8b
0x0474db8b
0x0474db8d
0x0474db9b
0x0474db9b
0x0474db9d
0x0474dba0
0x0474dba2
0x0474dba4
0x0474dba7
0x0474dba9
0x0474dbae
0x0474dbae
0x0474dbb1
0x0474dbb4
0x0474dbb4
0x0474dbb7
0x0474dbba
0x0474dcd2
0x0474dcd4
0x00000000
0x0474dbc0
0x0474dbc0
0x0474dbd2
0x0474dbd7
0x0474dbda
0x0474dbdd
0x0474dbdf
0x00000000
0x0474dbe5
0x0474dbe5
0x0474dbee
0x0474dbf1
0x0479b541
0x0479b544
0x00000000
0x0479b546
0x0479b546
0x00000000
0x0479b546
0x0474dbf7
0x0474dbf7
0x0474dbfd
0x0474dbfd
0x0474dbff
0x0474dc0b
0x0474dc15
0x0474dc1b
0x0474dc1d
0x0474dc21
0x0474dc21
0x0474dc23
0x0474dc23
0x0474dc26
0x0474dc29
0x0474dc2b
0x00000000
0x00000000
0x0474dc31
0x0474dc34
0x0474dc36
0x0474dcbf
0x0474dcbf
0x0474dcc2
0x00000000
0x0474dc3c
0x0474dc41
0x0474dc43
0x00000000
0x0474dc45
0x0474dc45
0x0474dc47
0x00000000
0x0474dc4d
0x0474dc4d
0x0474dc50
0x0474dc52
0x0474dc55
0x0474dcfa
0x0474dcfe
0x0474dd08
0x0474dd0a
0x0474dd0c
0x00000000
0x0474dd12
0x0474dd15
0x0474dd2d
0x0474dd2f
0x0474dd32
0x0474dd35
0x00000000
0x0474dd35
0x0474dc5b
0x0474dc5b
0x0474dc5e
0x0474dc61
0x0474dc64
0x0474dc67
0x0474dc67
0x0474dc6a
0x0474dc6c
0x0474dc8e
0x0474dc8e
0x0474dc91
0x0474dc93
0x0474dcce
0x0474dcce
0x0474dc95
0x0474dc9c
0x0474dc6e
0x0474dc72
0x0474dc75
0x0474dc77
0x0474dc79
0x0479b551
0x0479b551
0x00000000
0x0474dc7f
0x0474dc7f
0x0474dc81
0x00000000
0x0474dc83
0x0474dc86
0x0474dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x0474dc88
0x0474dc81
0x0474dc79
0x0474dc6c
0x0474dc55
0x0474dc47
0x0474dc43
0x00000000
0x0474dc36
0x0474dc23
0x00000000
0x0474dbff
0x0474dbf1
0x0474dbdf
0x0474db8f
0x0474db92
0x0474db95
0x00000000
0x00000000
0x00000000
0x00000000
0x0474db95
0x0474db8d
0x0474db85
0x0474db74
0x0474dc9f
0x0474dca2
0x0474dcb0
0x0474dcb0
0x0474dad1
0x0479b4e5
0x0479b4c8
0x00000000
0x00000000
0x00000000
0x0474d831
0x0474d80d
0x00000000
0x0474d800
0x0479b47f
0x0479b485
0x00000000
0x0479b485
0x0474d665
0x0474d652
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82460dd747dc6932281c83b5e2eef6858af1e1bc1f66f589ead98827bbd43e51
Instruction ID: 376722ad4d7ba3ffea31bb2b3a0a1c229ff98dbc9ca93100530cd562a5a8937b
Opcode Fuzzy Hash: 82460dd747dc6932281c83b5e2eef6858af1e1bc1f66f589ead98827bbd43e51
Instruction Fuzzy Hash: 9CE1BC30A00219CFEB35DF25D984BB9B7B6BF85318F0441A9D9899B390D774BD81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0474849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0474849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0x480f9c0);
				E0478D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0x4827b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E0474CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E04752280( *[fs:0x30], 0x4828550);
						_t139 =  *0x4827b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E0476F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E0474FFB0(_t193, _t235, 0x4828550);
								L5:
								return E0478D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E04731C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0x4827b9c; // 0x0
							_t235 = L04754620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0x4827b10; // 0x9
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E0476A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E0474FFB0(_t193, _t235, 0x4828550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L047577F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L047577F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0x4827b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0x4827b10; // 0x9
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E047737C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0x4827b9c; // 0x0
									_t214 = L04754620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E047737F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0x4827b10 =  *0x4827b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0x4827b04 =  *0x4827b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L047577F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L047577F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0x4827b08 =  *0x4827b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E047757C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E0477F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L047577F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E0476A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L047577F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E047796C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x0474849b
0x0474849b
0x0474849b
0x0474849b
0x0474849d
0x047484a2
0x047484a7
0x047484b1
0x047484d8
0x00000000
0x047484b3
0x047484c4
0x047484c9
0x047484cd
0x047484cf
0x047484cf
0x047484d6
0x047484e6
0x047484e9
0x047484ec
0x047484ef
0x047484f2
0x047484f4
0x047484fc
0x04748501
0x04748506
0x04748509
0x047486e0
0x047486e5
0x047486e8
0x047486ed
0x047486f0
0x047486f2
0x04799afd
0x04799b02
0x047484da
0x047484df
0x047484df
0x047486fa
0x047486fd
0x047486fe
0x04748701
0x04748706
0x04748709
0x0474870b
0x00000000
0x00000000
0x04748711
0x04748725
0x04748727
0x0474872a
0x0474872c
0x04799af0
0x04799af5
0x04748732
0x04748732
0x04748732
0x04748735
0x04748737
0x04748515
0x04748515
0x04748518
0x0474851d
0x04748523
0x04748527
0x0474852b
0x04748537
0x04748539
0x0474853c
0x0474853e
0x0474868c
0x04748691
0x04748699
0x0474869b
0x04748744
0x04748748
0x047486a1
0x047486a1
0x047486a1
0x047486a4
0x047486a8
0x04799bdf
0x04799bdf
0x047486ae
0x047486b0
0x00000000
0x047486b6
0x00000000
0x04799be9
0x047486b0
0x04748544
0x0474854a
0x0474854d
0x04748551
0x0474876e
0x04748778
0x0474877b
0x04748780
0x04748557
0x04748557
0x0474855d
0x0474855d
0x0474856b
0x0474856e
0x04748570
0x04748573
0x04748576
0x04748576
0x04748579
0x0474857b
0x00000000
0x00000000
0x04748581
0x047485a0
0x047485a2
0x047485a5
0x047485a7
0x04799b1b
0x04799b1b
0x0474862e
0x0474862e
0x04748631
0x04748631
0x04748634
0x04748636
0x04748669
0x04748669
0x0474866b
0x04799bbf
0x04799bc4
0x04799bc8
0x04799bce
0x04799bce
0x04748671
0x04748671
0x04748674
0x04748676
0x04799bae
0x04799bae
0x04748676
0x0474867c
0x0474867e
0x04748688
0x04748688
0x00000000
0x0474867e
0x04748638
0x04748638
0x0474863b
0x0474863e
0x0474863f
0x04748642
0x04748645
0x04748648
0x0474864d
0x04799b69
0x04799b6e
0x04799b7b
0x04799b81
0x04799b85
0x04799b89
0x04799ba7
0x04799b8b
0x04799b91
0x04799b9a
0x04799b9f
0x04799b9f
0x04748788
0x0474878d
0x04748763
0x04748763
0x04748766
0x00000000
0x04748766
0x04799b70
0x00000000
0x04799b70
0x04748656
0x0474865a
0x0474865c
0x04748752
0x04748756
0x00000000
0x00000000
0x0474875e
0x00000000
0x0474875e
0x04748662
0x04748662
0x04748662
0x04748666
0x00000000
0x04748666
0x047485b7
0x047485b9
0x047485bc
0x047485bf
0x047485cc
0x047485d1
0x047485d4
0x047485db
0x047485de
0x047485e0
0x04799b5f
0x00000000
0x04799b5f
0x047485e6
0x047485ea
0x047486c3
0x047486c5
0x047486c8
0x047486ca
0x04799b16
0x00000000
0x04799b16
0x047486d6
0x047485f6
0x047485f6
0x047485f9
0x04748602
0x04748606
0x0474860a
0x0474860b
0x0474860e
0x04748611
0x00000000
0x04748611
0x047485f3
0x00000000
0x047485f3
0x04748619
0x0474861e
0x0474861e
0x04748621
0x04748622
0x04748623
0x04748625
0x0474862c
0x00000000
0x0474873d
0x00000000
0x0474873d
0x04748737
0x0474850f
0x04748512
0x00000000
0x04748512
0x00000000
0x047484d6

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5e2c2b623e645cc1d461c7afa1aa6aeb5fc4cd85945d6695a0b4d6a0e4157b5
Instruction ID: 6eb4b105ab65af015a597d24c460be82d4568df76497328ff82b3b46df9c390b
Opcode Fuzzy Hash: a5e2c2b623e645cc1d461c7afa1aa6aeb5fc4cd85945d6695a0b4d6a0e4157b5
Instruction Fuzzy Hash: 95B16BB4E00209DFDB25EF99D984AADBBB9FF88304F11452AE505AB341E774BD41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0476513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0476513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0x482d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E0477D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E04752280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L04754620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E0477F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E0474FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0x482b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E0477B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x04765142
0x0476514c
0x04765150
0x04765157
0x04765159
0x0476515e
0x04765165
0x04765169
0x0476516c
0x04765172
0x04765176
0x0476517a
0x0476517a
0x0476517a
0x0476517f
0x047a6d8b
0x047a6d8e
0x047a6d91
0x047a6d95
0x047a6d98
0x047a6d9c
0x047a6da0
0x047a6da3
0x047a6da7
0x047a6e26
0x047a6e26
0x047a6e2a
0x047651f9
0x047651f9
0x047651fe
0x047a6e33
0x047a6e33
0x047a6e39
0x047a6e3d
0x047a6e46
0x047a6e50
0x00000000
0x00000000
0x047a6e52
0x047a6e53
0x047a6e56
0x047a6e5d
0x00000000
0x00000000
0x00000000
0x047a6e5f
0x047a6e67
0x047a6e77
0x047a6e7f
0x047a6e80
0x047a6e88
0x047a6e90
0x047a6e9f
0x047a6ea5
0x047a6ea9
0x047a6eb1
0x047a6ebf
0x00000000
0x00000000
0x047a6ecf
0x047a6ed3
0x00000000
0x00000000
0x047a6edb
0x047a6ede
0x047a6ee1
0x047a6ee8
0x047a6eeb
0x047a6eed
0x047a6ef0
0x047a6ef4
0x047a6ef8
0x047a6efc
0x00000000
0x00000000
0x047a6f0d
0x047a6f11
0x047a6f32
0x047a6f37
0x047a6f3b
0x047a6f3e
0x047a6f41
0x047a6f46
0x00000000
0x00000000
0x047a6f4c
0x047a6f50
0x047a6f50
0x047a6f54
0x047a6f62
0x047a6f65
0x047a6f6d
0x047a6f7b
0x047a6f7b
0x047a6f93
0x047a6f98
0x047a6fa0
0x047a6fa6
0x047a6fb3
0x047a6fb6
0x047a6fbf
0x047a6fc1
0x047a6fd5
0x047a6fda
0x047a6fda
0x047a6fdd
0x047a6fe2
0x047a6fe7
0x047a6feb
0x047a6fef
0x047a6ff3
0x0476520c
0x0476520c
0x0476520f
0x04765215
0x04765234
0x0476523a
0x0476523a
0x04765244
0x04765245
0x04765246
0x04765251
0x04765251
0x047a6f13
0x047a6f17
0x047a6f17
0x047a6f18
0x047a6f1b
0x047a6f1f
0x047a6f23
0x00000000
0x047a6f28
0x04765204
0x04765204
0x04765208
0x00000000
0x04765208
0x04765185
0x04765188
0x0476518a
0x0476518e
0x04765195
0x047a6db1
0x047a6db5
0x047a6db9
0x0476519b
0x0476519b
0x0476519e
0x047651a7
0x047651a9
0x047651a9
0x047651b5
0x047651b8
0x047651bb
0x047651be
0x047651c1
0x047651c5
0x047651c9
0x047651cd
0x047651cd
0x047651d8
0x047651dc
0x047651e0
0x047a6dcc
0x047a6dd0
0x047a6dd5
0x047a6ddd
0x047a6de1
0x047a6de1
0x047a6de5
0x047a6deb
0x047a6df1
0x047a6df7
0x047a6dfd
0x047a6e01
0x047a6e05
0x047a6e09
0x047a6e0d
0x047a6e11
0x047a6e11
0x047651eb
0x047a6e1a
0x047a6e1f
0x047a6e21
0x047a6e23
0x00000000
0x047651f1
0x047651f1
0x00000000
0x047651f1

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 176464f9f9cd5fc5243c7d40000decf9942e09c498fe4cf450ba65a1161ed511
Instruction ID: 4e47d6eb320bdb3d0442060c69f61fec40d203485221342415586466aea0e0da
Opcode Fuzzy Hash: 176464f9f9cd5fc5243c7d40000decf9942e09c498fe4cf450ba65a1161ed511
Instruction Fuzzy Hash: 76C112B56093809FD754CF28C580A5AFBE1BF88308F184A6EF9D98B352D771E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 047603E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E047603E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0x482d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E04760548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E0477B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E0474B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0x4827c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E04757D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E04757D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E047B7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E04779830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E047B69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0x4827c04 != 0) {
						_t118 = _v12;
						_t120 = E047BA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0x4827bd8;
						if( *0x4827bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E047795D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E047799A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E047B3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E0473B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E0477AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0x4828474 - 3;
										if( *0x4828474 != 3) {
											 *0x48279dc =  *0x48279dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E04757D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E04757D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E047B7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0x4828708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0x4827b00; // 0x0
							asm("ror esi, cl");
							 *0x482b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E047795D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E04747F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x047603f1
0x047603f7
0x047603f9
0x047603fb
0x047603fd
0x04760400
0x0476040a
0x047a4c7a
0x04760537
0x04760547
0x04760410
0x04760410
0x04760414
0x04760417
0x0476041a
0x04760421
0x04760424
0x0476042b
0x0476043b
0x0476043e
0x0476043f
0x0476043f
0x04760446
0x04760449
0x0476044c
0x0476044f
0x04760459
0x047a4c8d
0x0476045f
0x0476045f
0x0476045f
0x04760467
0x047a4c97
0x047a4c9d
0x047a4ca4
0x047a4caa
0x047a4caf
0x047a4cb1
0x047a4cc3
0x047a4cb3
0x047a4cbc
0x047a4cbc
0x047a4cc8
0x047a4ccb
0x047a4cd7
0x047a4cda
0x047a4cdf
0x047a4cdf
0x047a4ccb
0x047a4ca4
0x0476046d
0x0476046f
0x0476046f
0x04760471
0x04760476
0x0476047a
0x0476047b
0x04760483
0x04760489
0x0476048d
0x00000000
0x00000000
0x047a4ce9
0x047a4cef
0x047a4d22
0x047a4d22
0x00000000
0x047a4d22
0x047a4cf1
0x047a4cf7
0x00000000
0x00000000
0x047a4cf9
0x047a4cff
0x00000000
0x00000000
0x047a4d05
0x047a4d07
0x00000000
0x00000000
0x047a4d0d
0x047a4d0f
0x047a4d14
0x047a4d16
0x00000000
0x00000000
0x047a4d1c
0x047a4d1c
0x04760499
0x04760535
0x04760535
0x00000000
0x04760535
0x047604a6
0x047a4d2c
0x047a4d37
0x047a4d39
0x047a4d3b
0x00000000
0x00000000
0x047a4d41
0x047a4d48
0x04760527
0x0476052b
0x0476052d
0x04760530
0x04760530
0x00000000
0x0476052b
0x047a4d4e
0x047604ac
0x047604ac
0x047604af
0x047604b2
0x047604b7
0x047604b9
0x047604bb
0x047604bd
0x047604bf
0x047604c5
0x047604c9
0x047a4d53
0x047a4d59
0x047a4db9
0x047a4dba
0x047a4dbf
0x047a4dc2
0x047a4dc4
0x047a4dc7
0x047a4dce
0x00000000
0x047a4dce
0x047a4d5b
0x047a4d61
0x00000000
0x00000000
0x047a4d63
0x047a4d69
0x00000000
0x00000000
0x047a4d6b
0x047a4d6e
0x047a4d74
0x047a4d76
0x047a4d7c
0x047a4d7e
0x047a4d84
0x047a4d89
0x047a4d8c
0x047a4d8d
0x047a4d92
0x047a4d95
0x047a4d96
0x047a4d98
0x047a4d9a
0x047a4d9f
0x047a4da4
0x047a4da6
0x047a4da8
0x047a4daf
0x047a4db1
0x047a4db1
0x047a4daf
0x047a4da6
0x047a4d84
0x047a4d7c
0x00000000
0x047a4d74
0x047604d6
0x047a4de1
0x047604dc
0x047604dc
0x047604dc
0x047604e4
0x047a4deb
0x047a4df1
0x047a4df8
0x047a4dfe
0x047a4e03
0x047a4e05
0x047a4e17
0x047a4e07
0x047a4e10
0x047a4e10
0x047a4e1c
0x047a4e1f
0x047a4e35
0x047a4e35
0x047a4e1f
0x047a4df8
0x047604f1
0x047604fa
0x047a4e3f
0x047a4e47
0x047a4e5b
0x047a4e61
0x047a4e67
0x047a4e69
0x047a4e71
0x047a4e73
0x04760500
0x04760500
0x04760500
0x047604fa
0x04760508
0x0476051d
0x0476051d
0x0476051f
0x04760524
0x00000000
0x04760524
0x04760515
0x04760517
0x047a4e7a
0x047a4e7c
0x00000000
0x00000000
0x047a4e85
0x00000000
0x047a4e85
0x00000000
0x04760517

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa191858d12daeec1e39664826a76c56276af90d32cdc03ae1f4b85e5ee59fdd
Instruction ID: ef3a7d2db1abe40d10103865cda6173b9a2c5ab761368007ed4acc6d32335c27
Opcode Fuzzy Hash: fa191858d12daeec1e39664826a76c56276af90d32cdc03ae1f4b85e5ee59fdd
Instruction Fuzzy Hash: 2691F531E00254AFEB31DB69C848BAD7BA6AB42714F150361ED12AB3D1E7B5BD50C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 0476EBB0, Relevance: .2, Instructions: 250
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0476EBB0(signed int* _a4, intOrPtr _a8, intOrPtr* _a12, signed short* _a16, unsigned int _a20) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				unsigned int _v20;
				intOrPtr _t42;
				unsigned int _t43;
				unsigned int _t50;
				signed char _t56;
				signed char _t60;
				signed int _t63;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				unsigned int _t82;
				signed int _t87;
				signed int _t91;
				signed short _t96;
				signed short* _t98;
				signed char _t100;
				signed int* _t102;
				signed short* _t105;
				intOrPtr _t106;
				signed int _t108;
				signed int* _t110;
				void* _t113;
				signed int _t115;
				signed short* _t117;
				signed int _t118;

				_t98 = _a16;
				_t87 = 0;
				_v16 = 0;
				if(_t98 == 0) {
					return 0xc00000f2;
				}
				_t110 = _a4;
				if(_t110 == 0) {
					if(_a12 == 0) {
						_t42 = 0xc000000d;
					} else {
						_t42 = E0476ED1A(_t98, _a20, _a12);
					}
					L19:
					return _t42;
				}
				_t43 = _a20;
				if((_t43 & 0x00000001) != 0) {
					_t42 = 0xc00000f3;
					goto L19;
				} else {
					_t102 = _t110;
					_t105 =  &(_t98[_t43 >> 1]);
					_v8 = _t105;
					_v12 = _a8 + _t110;
					L4:
					while(1) {
						L4:
						while(1) {
							L4:
							if(_t98 >= _t105) {
								if(_t87 == 0) {
									L17:
									_t106 = _v16;
									L18:
									_t42 = _t106;
									 *_a12 = _t102 - _a4;
									goto L19;
								}
								L8:
								_t13 = _t87 - 0xd800; // -55295
								if(_t13 <= 0x7ff) {
									_v16 = 0x107;
									_t87 = 0xfffd;
								}
								_t113 = 1;
								if(_t87 > 0x7f) {
									if(_t87 > 0x7ff) {
										if(_t87 > 0xffff) {
											_t113 = 2;
										}
										_t113 = _t113 + 1;
									}
									_t113 = _t113 + 1;
								}
								if(_t102 > _v12 - _t113) {
									_t106 = 0xc0000023;
									goto L18;
								} else {
									if(_t87 > 0x7f) {
										_t50 = _t87;
										if(_t87 > 0x7ff) {
											if(_t87 > 0xffff) {
												 *_t102 = _t50 >> 0x00000012 | 0x000000f0;
												_t102 =  &(_t102[0]);
												_t56 = _t87 >> 0x0000000c & 0x0000003f | 0x00000080;
											} else {
												_t56 = _t50 >> 0x0000000c | 0x000000e0;
											}
											 *_t102 = _t56;
											_t102 =  &(_t102[0]);
											_t60 = _t87 >> 0x00000006 & 0x0000003f | 0x00000080;
										} else {
											_t60 = _t50 >> 0x00000006 | 0x000000c0;
										}
										 *_t102 = _t60;
										_t102 =  &(_t102[0]);
										_t87 = _t87 & 0x0000003f | 0x00000080;
									}
									 *_t102 = _t87;
									_t102 =  &(_t102[0]);
									_t63 = _t105 - _t98 >> 1;
									_t115 = _v12 - _t102;
									if(_t63 > 0xd) {
										if(_t115 < _t63) {
											_t63 = _t115;
										}
										_t22 = _t63 - 5; // -5
										_t117 =  &(_t98[_t22]);
										if(_t98 < _t117) {
											do {
												_t91 =  *_t98 & 0x0000ffff;
												_t100 =  &(_t98[1]);
												if(_t91 > 0x7f) {
													L58:
													if(_t91 > 0x7ff) {
														_t38 = _t91 - 0xd800; // -55296
														if(_t38 <= 0x7ff) {
															if(_t91 > 0xdbff) {
																_t98 = _t100 - 2;
																break;
															}
															_t108 =  *_t100 & 0x0000ffff;
															_t98 = _t100 + 2;
															_t39 = _t108 - 0xdc00; // -54273
															if(_t39 > 0x3ff) {
																_t98 = _t98 - 4;
																break;
															}
															_t91 = (_t91 << 0xa) + 0xfca02400 + _t108;
															 *_t102 = _t91 >> 0x00000012 | 0x000000f0;
															_t102 =  &(_t102[0]);
															_t73 = _t91 & 0x0003f000 | 0x00080000;
															L65:
															_t117 = _t117 - 2;
															 *_t102 = _t73 >> 0xc;
															_t102 =  &(_t102[0]);
															_t77 = _t91 & 0x00000fc0 | 0x00002000;
															L66:
															 *_t102 = _t77 >> 6;
															_t117 = _t117 - 2;
															_t102[0] = _t91 & 0x0000003f | 0x00000080;
															_t102 =  &(_t102[0]);
															goto L30;
														}
														_t73 = _t91 | 0x000e0000;
														goto L65;
													}
													_t77 = _t91 | 0x00003000;
													goto L66;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												if((_t100 & 0x00000002) != 0) {
													_t91 =  *_t100 & 0x0000ffff;
													_t100 = _t100 + 2;
													if(_t91 > 0x7f) {
														goto L58;
													}
													 *_t102 = _t91;
													_t102 =  &(_t102[0]);
												}
												if(_t100 >= _t117) {
													break;
												} else {
													goto L28;
												}
												while(1) {
													L28:
													_t80 =  *(_t100 + 4);
													_t96 =  *_t100;
													_v20 = _t80;
													if(((_t80 | _t96) & 0xff80ff80) != 0) {
														break;
													}
													_t82 = _v20;
													_t100 = _t100 + 8;
													 *_t102 = _t96;
													_t102[0] = _t82;
													_t102[0] = _t96 >> 0x10;
													_t102[0] = _t82 >> 0x10;
													_t102 =  &(_t102[1]);
													if(_t100 < _t117) {
														continue;
													}
													goto L30;
												}
												_t91 = _t96 & 0x0000ffff;
												_t100 = _t100 + 2;
												if(_t91 > 0x7f) {
													goto L58;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												L30:
											} while (_t98 < _t117);
											_t105 = _v8;
										}
										goto L32;
									} else {
										if(_t115 < _t63) {
											L32:
											_t87 = 0;
											continue;
										}
										while(_t98 < _t105) {
											_t87 =  *_t98 & 0x0000ffff;
											_t98 =  &(_t98[1]);
											if(_t87 > 0x7f) {
												L7:
												_t12 = _t87 - 0xd800; // -55290
												if(_t12 <= 0x3ff) {
													goto L4;
												}
												goto L8;
											}
											 *_t102 = _t87;
											_t102 =  &(_t102[0]);
										}
										goto L17;
									}
								}
							}
							_t118 =  *_t98 & 0x0000ffff;
							if(_t87 != 0) {
								_t36 = _t118 - 0xdc00; // -56314
								if(_t36 <= 0x3ff) {
									_t87 = (_t87 << 0xa) + 0xfca02400 + _t118;
									_t98 =  &(_t98[1]);
								}
								goto L8;
							}
							_t87 = _t118;
							_t98 =  &(_t98[1]);
							goto L7;
						}
					}
				}
			}

0x0476ebb8
0x0476ebbf
0x0476ebc1
0x0476ebc6
0x00000000
0x047ab6d6
0x0476ebcd
0x0476ebd2
0x0476ec95
0x047ab6e0
0x0476ec9b
0x0476eca1
0x0476eca1
0x0476ec89
0x00000000
0x0476ec89
0x0476ebd8
0x0476ebdd
0x047ab6ea
0x00000000
0x0476ebe3
0x0476ebe5
0x0476ebe7
0x0476ebef
0x0476ebf2
0x00000000
0x0476ebf5
0x00000000
0x0476ebf5
0x0476ebf5
0x0476ebf7
0x047ab6f6
0x0476ec7c
0x0476ec7c
0x0476ec7f
0x0476ec82
0x0476ec87
0x00000000
0x0476ec87
0x0476ec1a
0x0476ec1a
0x0476ec25
0x047ab725
0x047ab72c
0x047ab72c
0x0476ec2d
0x0476ec31
0x047ab73c
0x047ab744
0x047ab748
0x047ab748
0x047ab749
0x047ab749
0x047ab74a
0x047ab74a
0x0476ec3e
0x047ab860
0x00000000
0x0476ec44
0x0476ec47
0x047ab750
0x047ab758
0x047ab767
0x047ab775
0x047ab77c
0x047ab77f
0x047ab769
0x047ab76c
0x047ab76c
0x047ab781
0x047ab788
0x047ab78b
0x047ab75a
0x047ab75d
0x047ab75d
0x047ab78d
0x047ab792
0x047ab793
0x047ab793
0x0476ec54
0x0476ec56
0x0476ec57
0x0476ec59
0x0476ec5e
0x0476ecaa
0x0476ed16
0x0476ed16
0x0476ecac
0x0476ecaf
0x0476ecb4
0x0476ecb6
0x0476ecb6
0x0476ecb9
0x0476ecbf
0x047ab7c1
0x047ab7c8
0x047ab7d3
0x047ab7db
0x047ab7ec
0x047ab858
0x00000000
0x047ab858
0x047ab7ee
0x047ab7f1
0x047ab7f4
0x047ab7ff
0x047ab850
0x00000000
0x047ab850
0x047ab80a
0x047ab813
0x047ab81c
0x047ab81d
0x047ab822
0x047ab825
0x047ab828
0x047ab831
0x047ab832
0x047ab837
0x047ab840
0x047ab842
0x047ab845
0x047ab848
0x00000000
0x047ab848
0x047ab7df
0x00000000
0x047ab7df
0x047ab7cc
0x00000000
0x047ab7cc
0x0476ecc5
0x0476ecc7
0x0476eccb
0x047ab79b
0x047ab79e
0x047ab7a4
0x00000000
0x00000000
0x047ab7a6
0x047ab7a8
0x047ab7a8
0x0476ecd3
0x00000000
0x00000000
0x00000000
0x00000000
0x0476ecd5
0x0476ecd5
0x0476ecd5
0x0476ecd8
0x0476ecda
0x0476ece4
0x00000000
0x00000000
0x0476ecea
0x0476eced
0x0476ecf0
0x0476ecf2
0x0476ecfb
0x0476ecfe
0x0476ed01
0x0476ed06
0x00000000
0x00000000
0x00000000
0x0476ed06
0x047ab7ae
0x047ab7b1
0x047ab7b7
0x00000000
0x00000000
0x047ab7b9
0x047ab7bb
0x0476ed08
0x0476ed08
0x0476ed0c
0x0476ed0c
0x00000000
0x0476ec60
0x0476ec62
0x0476ed0f
0x0476ed0f
0x00000000
0x0476ed0f
0x0476ec68
0x0476ec6c
0x0476ec6f
0x0476ec75
0x0476ec0d
0x0476ec0d
0x0476ec18
0x00000000
0x00000000
0x00000000
0x0476ec18
0x0476ec77
0x0476ec79
0x0476ec79
0x00000000
0x0476ec68
0x0476ec5e
0x0476ec3e
0x0476ebfd
0x0476ec02
0x047ab701
0x047ab70c
0x047ab71b
0x047ab71d
0x047ab71d
0x00000000
0x047ab70c
0x0476ec08
0x0476ec0a
0x00000000
0x0476ec0a
0x0476ebf5
0x0476ebf5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 7a79e631fbc05545d00a6748956a3b0819eee353b7c093b51d7a96615a9ae834
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: DB814935A04256CBDB214E6DC8C02BDBB56EF92300F28477BDD438F341D265B85AE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 04801D55, Relevance: .2, Instructions: 226
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E04801D55(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t97;
				signed int _t101;
				signed int _t112;
				unsigned int _t113;
				signed int _t121;
				signed int _t128;
				signed int _t130;
				signed char _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t144;
				signed int _t149;
				signed int _t150;
				void* _t154;
				signed int* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				intOrPtr _t171;
				signed int _t172;
				void* _t175;
				signed int* _t178;
				signed int _t179;
				signed int _t180;
				signed char _t181;
				signed char _t183;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				void* _t191;
				void* _t197;

				_t137 = __ecx;
				_push(0x64);
				_push(0x4811070);
				E0478D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x24) = __edx;
				 *((intOrPtr*)(_t191 - 0x20)) = __ecx;
				 *((intOrPtr*)(_t191 - 0x38)) = __ecx;
				_t135 = 0;
				 *(_t191 - 0x40) = 0;
				_t171 =  *((intOrPtr*)(__ecx + 0xc));
				_t189 =  *(__ecx + 8);
				 *(_t191 - 0x28) = _t189;
				 *((intOrPtr*)(_t191 - 0x3c)) = _t171;
				 *(_t191 - 0x50) = _t189;
				_t187 = __edx << 0xf;
				 *(_t191 - 0x4c) = _t187;
				_t190 = 0x8000;
				 *(_t191 - 0x34) = 0x8000;
				_t172 = _t171 - _t187;
				if(_t172 <= 0x8000) {
					_t190 = _t172;
					 *(_t191 - 0x34) = _t172;
				}
				 *(_t191 - 0x68) = _t135;
				 *(_t191 - 0x64) = _t135;
				L3:
				while(1) {
					if( *(_t191 + 8) != 0) {
						L22:
						 *(_t191 + 8) = _t135;
						E0480337F(_t137, 1, _t191 - 0x74);
						_t97 =  *((intOrPtr*)(_t191 - 0x20));
						_t175 =  *(_t97 + 0x14);
						 *(_t191 - 0x58) = _t175;
						_t139 = _t97 + 0x14;
						 *(_t191 - 0x44) = _t139;
						_t197 = _t175 - 0xffffffff;
						if(_t197 == 0) {
							 *_t139 =  *(_t191 - 0x24);
							E048033B6(_t191 - 0x74);
							 *(_t191 - 0x40) = 1;
							_t60 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t101 =  *_t60;
							_t141 =  *(_t191 - 0x24);
							asm("bt [eax], ecx");
							_t103 = (_t101 & 0xffffff00 | __eflags > 0x00000000) & 0x000000ff;
							if(__eflags == 0) {
								goto L41;
							} else {
								_t103 = _t187 - 1 + _t190;
								__eflags = _t187 - 1 + _t190 -  *((intOrPtr*)(_t191 - 0x3c));
								if(_t187 - 1 + _t190 >=  *((intOrPtr*)(_t191 - 0x3c))) {
									goto L41;
								} else {
									__eflags = _t190 - 1;
									if(__eflags > 0) {
										_t143 =  *(_t191 - 0x28);
										_t178 = _t143 + (_t187 >> 5) * 4;
										_t144 = _t143 + (_t187 - 1 + _t190 >> 5) * 4;
										 *(_t191 - 0x50) = _t144;
										_t112 =  *_t178;
										 *(_t191 - 0x54) = _t112;
										_t113 = _t112 | 0xffffffff;
										__eflags = _t178 - _t144;
										if(_t178 != _t144) {
											_t103 = _t113 << _t187;
											__eflags =  *_t178 & _t103;
											if(( *_t178 & _t103) != 0) {
												goto L41;
											} else {
												_t103 =  *(_t191 - 0x50);
												while(1) {
													_t178 =  &(_t178[1]);
													__eflags = _t178 - _t103;
													if(_t178 == _t103) {
														break;
													}
													__eflags =  *_t178 - _t135;
													if( *_t178 != _t135) {
														goto L41;
													} else {
														continue;
													}
													goto L42;
												}
												_t103 = (_t103 | 0xffffffff) >>  !(_t187 - 1 + _t190);
												__eflags = _t103;
												_t149 =  *_t178;
												goto L38;
											}
										} else {
											_t154 = 0x20;
											_t103 = _t113 >> _t154 - _t190 << _t187;
											_t149 =  *(_t191 - 0x54);
											L38:
											_t150 = _t149 & _t103;
											__eflags = _t150;
											asm("sbb cl, cl");
											_t135 =  ~_t150 + 1;
											_t141 =  *(_t191 - 0x24);
											goto L39;
										}
									} else {
										if(__eflags != 0) {
											goto L41;
										} else {
											_t103 =  *(_t191 - 0x28);
											asm("bt [eax], edi");
											if(__eflags >= 0) {
												L40:
												_t136 =  *((intOrPtr*)(_t191 - 0x20));
												asm("lock btr [eax], ecx");
												 *((intOrPtr*)(_t191 - 0x60)) = (_t141 << 0xc) +  *((intOrPtr*)(_t136 + 8));
												 *((intOrPtr*)(_t191 - 0x5c)) = 0x1000;
												_push(0x4000);
												_push(_t191 - 0x5c);
												_push(_t191 - 0x60);
												_push(0xffffffff);
												_t103 = E047796E0();
											} else {
												L39:
												__eflags = _t135;
												if(_t135 == 0) {
													goto L41;
												} else {
													goto L40;
												}
											}
										}
									}
								}
							}
						} else {
							E048033B6(_t191 - 0x74);
							_t172 = _t191 - 0x58;
							E0476E18B( *(_t191 - 0x44), _t172, 4, _t135,  *0x4825880);
							_t51 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t121 =  *_t51;
							asm("bt [eax], ecx");
							_t103 = (_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff;
							if(((_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff) == 0) {
								goto L41;
							} else {
								_t137 =  *((intOrPtr*)(_t191 - 0x20));
								continue;
							}
						}
					} else {
						 *(_t191 - 4) = _t135;
						_t103 = _t187 - 1 + _t190;
						 *(_t191 - 0x30) = _t103;
						if(_t103 <  *((intOrPtr*)(_t191 - 0x3c))) {
							__eflags = _t190 - 1;
							if(__eflags > 0) {
								_t179 =  *(_t191 - 0x28);
								_t161 = _t179 + (_t187 >> 5) * 4;
								 *(_t191 - 0x2c) = _t161;
								_t128 = _t179 + ( *(_t191 - 0x30) >> 5) * 4;
								 *(_t191 - 0x44) = _t128;
								_t180 =  *_t161;
								__eflags = _t161 - _t128;
								if(_t161 != _t128) {
									_t103 = (_t128 | 0xffffffff) << _t187;
									__eflags = _t103 & _t180;
									if((_t103 & _t180) != 0) {
										goto L5;
									} else {
										_t130 =  *(_t191 - 0x2c);
										_t164 =  *(_t191 - 0x44);
										while(1) {
											_t130 = _t130 + 4;
											 *(_t191 - 0x2c) = _t130;
											_t180 =  *_t130;
											__eflags = _t130 - _t164;
											if(_t130 == _t164) {
												break;
											}
											__eflags = _t180;
											if(_t180 == 0) {
												continue;
											} else {
												goto L5;
											}
											goto L19;
										}
										_t103 = (_t130 | 0xffffffff) >>  !( *(_t191 - 0x30));
										__eflags = _t103;
										goto L17;
									}
								} else {
									_t167 = 0x20;
									_t103 = (_t128 | 0xffffffff) >> _t167 - _t190 << _t187;
									L17:
									_t183 =  ~(_t180 & _t103);
									asm("sbb dl, dl");
									goto L18;
								}
							} else {
								if(__eflags != 0) {
									goto L5;
								} else {
									_t103 =  *(_t191 - 0x28);
									asm("bt [eax], edi");
									_t183 =  ~(_t172 & 0xffffff00 | __eflags > 0x00000000);
									asm("sbb dl, dl");
									L18:
									_t181 = _t183 + 1;
									__eflags = _t181;
								}
							}
						} else {
							L5:
							_t181 = _t135;
						}
						L19:
						 *(_t191 - 0x19) = _t181;
						_t163 = _t181 & 0x000000ff;
						 *(_t191 - 0x48) = _t163;
						 *(_t191 - 4) = 0xfffffffe;
						if(_t163 == 0) {
							L41:
							_t136 =  *((intOrPtr*)(_t191 - 0x20));
						} else {
							_t137 =  *((intOrPtr*)(_t191 - 0x20));
							goto L22;
						}
					}
					L42:
					__eflags =  *(_t191 - 0x40);
					if( *(_t191 - 0x40) != 0) {
						_t91 = _t136 + 0x14; // 0x14
						_t142 = _t91;
						 *_t91 = 0xffffffff;
						__eflags = 0;
						asm("lock or [eax], edx");
						_t103 = E0476DFDF(_t91, 1, _t142);
					}
					return E0478D0D1(_t103);
				}
			}

0x04801d55
0x04801d55
0x04801d57
0x04801d5c
0x04801d63
0x04801d66
0x04801d69
0x04801d6c
0x04801d6e
0x04801d71
0x04801d74
0x04801d77
0x04801d7a
0x04801d7d
0x04801d82
0x04801d85
0x04801d88
0x04801d8d
0x04801d90
0x04801d94
0x04801d96
0x04801d98
0x04801d98
0x04801d9b
0x04801d9e
0x00000000
0x04801da1
0x04801da5
0x04801e78
0x04801e78
0x04801e82
0x04801e87
0x04801e8a
0x04801e8d
0x04801e92
0x04801e95
0x04801e98
0x04801e9b
0x04801ede
0x04801ee3
0x04801ee8
0x04801ef2
0x04801ef2
0x04801ef5
0x04801ef8
0x04801efe
0x04801f03
0x00000000
0x04801f09
0x04801f0c
0x04801f0e
0x04801f11
0x00000000
0x04801f17
0x04801f17
0x04801f1a
0x04801f31
0x04801f34
0x04801f3f
0x04801f42
0x04801f45
0x04801f47
0x04801f4a
0x04801f4d
0x04801f4f
0x04801f63
0x04801f65
0x04801f67
0x00000000
0x04801f69
0x04801f69
0x04801f72
0x04801f72
0x04801f75
0x04801f77
0x00000000
0x00000000
0x04801f6e
0x04801f70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x04801f70
0x04801f83
0x04801f83
0x04801f85
0x00000000
0x04801f85
0x04801f51
0x04801f53
0x04801f5a
0x04801f5c
0x04801f87
0x04801f87
0x04801f87
0x04801f8b
0x04801f8d
0x04801f90
0x00000000
0x04801f90
0x04801f1c
0x04801f1c
0x00000000
0x04801f22
0x04801f22
0x04801f25
0x04801f28
0x04801f97
0x04801f97
0x04801f9d
0x04801fa7
0x04801faa
0x04801fb1
0x04801fb9
0x04801fbd
0x04801fbe
0x04801fc0
0x04801f2a
0x04801f93
0x04801f93
0x04801f95
0x00000000
0x00000000
0x00000000
0x00000000
0x04801f95
0x04801f28
0x04801f1c
0x04801f1a
0x04801f11
0x04801e9d
0x04801ea0
0x04801eae
0x04801eb4
0x04801ebc
0x04801ebc
0x04801ec2
0x04801ec8
0x04801ecd
0x00000000
0x04801ed3
0x04801ed3
0x00000000
0x04801ed3
0x04801ecd
0x04801dab
0x04801dab
0x04801db1
0x04801db3
0x04801db9
0x04801dbf
0x04801dc2
0x04801dda
0x04801ddd
0x04801de0
0x04801de9
0x04801dec
0x04801def
0x04801df1
0x04801df3
0x04801e0a
0x04801e0c
0x04801e0e
0x00000000
0x04801e10
0x04801e10
0x04801e13
0x04801e16
0x04801e16
0x04801e19
0x04801e1c
0x04801e1e
0x04801e20
0x00000000
0x00000000
0x04801e22
0x04801e24
0x00000000
0x04801e26
0x00000000
0x04801e26
0x00000000
0x04801e24
0x04801e30
0x04801e30
0x00000000
0x04801e30
0x04801df5
0x04801df7
0x04801e01
0x04801e32
0x04801e34
0x04801e36
0x00000000
0x04801e36
0x04801dc4
0x04801dc4
0x00000000
0x04801dc6
0x04801dc6
0x04801dc9
0x04801dcf
0x04801dd1
0x04801e38
0x04801e38
0x04801e38
0x04801e38
0x04801dc4
0x04801dbb
0x04801dbb
0x04801dbb
0x04801dbb
0x04801e3a
0x04801e3a
0x04801e3d
0x04801e40
0x04801e43
0x04801e6f
0x04801fc7
0x04801fc7
0x04801e75
0x04801e75
0x00000000
0x04801e75
0x04801e6f
0x04801fca
0x04801fca
0x04801fce
0x04801fd0
0x04801fd0
0x04801fd3
0x04801fd9
0x04801fde
0x04801fe4
0x04801fe4
0x04801fee
0x04801fee

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044496ecb3a065bc8ea17688695d38ebf4af2413aa00e30f40402733a693b7e5
Instruction ID: 5875c1ebda155eefb66af4d8930cbcaab8a9cf6efa21dab9240074613afa57df
Opcode Fuzzy Hash: 044496ecb3a065bc8ea17688695d38ebf4af2413aa00e30f40402733a693b7e5
Instruction Fuzzy Hash: 2D814C71E102198BDF58DFA8C9849ECB7B1BF49324B148759E412EB3D4DB32A945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0473C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0473C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0x482d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E04746D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E0477B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0x4827b9c; // 0x0
					_t74 = L04754620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E04779650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L047577F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E0477F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E047713C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L047577F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E04779650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x0473c608
0x0473c615
0x0473c625
0x0473c62d
0x0473c635
0x0473c640
0x0473c680
0x0473c687
0x0473c688
0x0473c689
0x0473c694
0x0473c694
0x0473c642
0x0473c64a
0x0473c697
0x047a7a25
0x047a7a2b
0x047a7a2e
0x047a7a30
0x047a7bea
0x047a7bea
0x00000000
0x047a7bea
0x047a7a36
0x047a7a43
0x047a7a48
0x047a7a4c
0x047a7a4e
0x00000000
0x00000000
0x047a7a58
0x047a7a5a
0x047a7a5b
0x047a7a5c
0x047a7a5d
0x047a7a63
0x047a7a64
0x047a7a6a
0x047a7a6c
0x047a7a6e
0x047a79cb
0x047a79cb
0x047a79ce
0x047a79d0
0x047a7a98
0x047a7a9b
0x047a7a9b
0x047a7a9e
0x047a7aa1
0x047a7bbe
0x047a7bbe
0x047a7bc0
0x047a7be0
0x047a7be0
0x047a7a01
0x047a7a01
0x047a7a05
0x047a7a07
0x047a7a15
0x047a7a15
0x047a7a1a
0x00000000
0x047a7a1a
0x047a7bc2
0x047a7bc6
0x047a7bc9
0x047a7bcd
0x047a7bcf
0x047a79e6
0x047a79e6
0x047a79eb
0x047a79eb
0x047a79ef
0x047a79f1
0x00000000
0x00000000
0x047a79f3
0x047a79f5
0x047a79ff
0x047a79ff
0x00000000
0x047a79ff
0x047a79f7
0x047a79fd
0x00000000
0x00000000
0x00000000
0x047a79fd
0x047a7bd5
0x047a7bd8
0x00000000
0x00000000
0x047a7ba9
0x047a7bac
0x047a7bb0
0x047a7bb1
0x047a7bb1
0x047a7bb6
0x00000000
0x047a7bb6
0x047a7aa7
0x047a7aaa
0x00000000
0x00000000
0x047a7ab2
0x047a7ab3
0x047a7ab5
0x047a7aec
0x047a7aef
0x047a7b25
0x047a7b28
0x047a7b62
0x047a7b64
0x047a7b8f
0x047a7b92
0x047a7b96
0x047a7b98
0x00000000
0x00000000
0x047a7b9e
0x047a7b9f
0x047a7ba3
0x00000000
0x047a7ba3
0x047a7b66
0x047a7b68
0x047a7ae2
0x047a7ae2
0x00000000
0x047a7ae2
0x047a7b6e
0x047a7b72
0x047a7b75
0x047a7b81
0x047a7b85
0x047a7b87
0x00000000
0x00000000
0x047a7b31
0x047a7b34
0x047a7b3c
0x047a7b45
0x047a7b46
0x047a7b4f
0x047a7b51
0x047a7b57
0x047a7b59
0x047a7b59
0x00000000
0x047a7b59
0x047a7b77
0x00000000
0x047a7b77
0x047a7b2a
0x00000000
0x047a7b2a
0x047a7af1
0x047a7af3
0x00000000
0x00000000
0x047a7afb
0x047a7afc
0x047a7afe
0x00000000
0x00000000
0x047a7b00
0x047a7b03
0x00000000
0x00000000
0x047a7b05
0x047a7b09
0x047a7b0d
0x047a7b0f
0x00000000
0x00000000
0x047a7b18
0x047a7b1d
0x00000000
0x047a7b1d
0x047a7ab7
0x047a7ab9
0x00000000
0x00000000
0x047a7abf
0x047a7ac1
0x00000000
0x00000000
0x047a7ac3
0x047a7ac6
0x00000000
0x00000000
0x047a7ac8
0x047a7acc
0x047a7ad0
0x047a7ad2
0x00000000
0x00000000
0x047a7adb
0x00000000
0x047a7adb
0x047a79d6
0x047a79d9
0x047a79dc
0x047a7a91
0x047a7a94
0x00000000
0x047a7a94
0x047a79e2
0x00000000
0x047a79e2
0x047a7a74
0x047a7a7a
0x00000000
0x00000000
0x047a7a8a
0x047a7a21
0x047a7a21
0x00000000
0x047a7a21
0x0473c650
0x0473c651
0x0473c656
0x0473c65c
0x0473c65d
0x0473c663
0x0473c664
0x0473c66a
0x0473c66e
0x047a79c5
0x047a79c7
0x00000000
0x047a79c7
0x0473c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87186f8a6a6d091c90c15efb258072450773a62c69140271913d8d5c5e965fd8
Instruction ID: 38d5e520648b0a7359b4951b9b7d98024928e3ccc151ac719b26ec9cdf8d36d4
Opcode Fuzzy Hash: 87186f8a6a6d091c90c15efb258072450773a62c69140271913d8d5c5e965fd8
Instruction Fuzzy Hash: A8817EB5608301DFDB29CF19C880A6BB7A9EBC4354F144A6AED459B350E330FD55CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 047FDBD2, Relevance: .2, Instructions: 212
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E047FDBD2(intOrPtr* __ecx, unsigned int __edx, intOrPtr _a4, intOrPtr _a8) {
				char _v5;
				signed short _v12;
				unsigned int _v16;
				intOrPtr* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed short _v40;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int* _t75;
				signed short _t77;
				intOrPtr _t78;
				signed int _t92;
				signed int _t98;
				signed int _t99;
				signed short _t105;
				unsigned int _t108;
				void* _t112;
				unsigned int _t119;
				signed int _t124;
				intOrPtr _t137;
				signed char _t139;
				signed int _t140;
				unsigned int _t141;
				signed char _t142;
				intOrPtr _t152;
				signed int _t153;
				signed int _t158;
				signed int _t159;
				intOrPtr _t172;
				signed int _t176;
				signed int _t178;
				signed short _t182;
				intOrPtr _t183;

				_t119 = __edx;
				_v20 = __ecx;
				_t152 = _a4;
				_t172 = 0;
				_t182 = __edx >> 0x0000000c ^  *(__edx + 0x18) ^  *0x4826114;
				_v16 = __edx;
				_v36 = 0;
				_v5 = 0xff;
				_v40 = _t182;
				_v24 = _t182 >> 0x10;
				if(_t152 == 0) {
					L14:
					_t124 =  *(_t119 + 0x12) & 0x0000ffff;
					_v24 = _t124;
					_t183 = _v36;
					_t53 = _t119 + 0x10; // 0x10
					_t75 = _t53;
					_v28 = _t75;
					_t77 =  *_t75 & 0x0000ffff;
					_v12 = _t77;
					L15:
					while(1) {
						if(_t183 != 0) {
							L20:
							_t153 = _t77 + 0x00000001 & 0x0000ffff;
							asm("lock cmpxchg [ebx], cx");
							_t119 = _v16;
							_t77 = _t77 & 0x0000ffff;
							_v12 = _t77;
							if(_t153 == (_t77 & 0x0000ffff) + 1) {
								if(_t77 == 0) {
									_t78 = _t172;
									L27:
									_t119 = E047FD016(_t119, _t183, _t119, _t78);
									E0474FFB0(_t119, _t172, _t183 + 8);
									_t183 = _t172;
									if(_t119 != 0) {
										E047FC52D(_v20,  *((intOrPtr*)(_v20 + 0x78 + ( *(((_v40 & 0x0000ffff) + 7 >> 3) + 0x471aff8) & 0x000000ff) * 4)), _t119, _a8);
									}
									L29:
									_t172 = 1;
									if(_t183 != 0) {
										_t72 = _t183 + 8; // 0x8
										E0474FFB0(_t119, 1, _t72);
									}
									L31:
									return _t172;
								}
								if((_t77 & 0x0000ffff) != _v24 - 1) {
									goto L29;
								}
								_t78 = 2;
								goto L27;
							}
							_t124 = _v24;
							continue;
						}
						if(_t77 == 0 || (_t77 & 0x0000ffff) == _t124 - 1) {
							_t183 = E047FE018(_t119,  &_v5);
							if(_t183 == 0) {
								_t172 = 1;
								goto L31;
							}
							goto L19;
						} else {
							L19:
							_t77 = _v12;
							goto L20;
						}
					}
				}
				_t92 = _t182 & 0x0000ffff;
				_v28 = _t92;
				_t137 =  *((intOrPtr*)(__ecx + 0x78 + ( *((_t92 + 7 >> 3) + 0x471aff8) & 0x000000ff) * 4));
				_t98 =  *((intOrPtr*)(_t137 + 0x24));
				_t158 = _t152 - (_v24 & 0x0000ffff) - __edx;
				_v24 = _t98;
				_t99 = _t158;
				_v32 = _t158;
				_t139 =  *(_t137 + 0x28) & 0x000000ff;
				if(_t98 == 0) {
					_v12 = _t99 >> _t139;
					_t159 = _t158 & (1 << _t139) - 0x00000001;
					_t105 = _v12;
				} else {
					_t105 = E0477D340(_t99 * _v24, _t139, _t99 * _v24 >> 0x20);
					_v12 = _t105;
					_t159 = _v32 - _v28 * _t105;
				}
				if(_t159 == 0) {
					_t140 =  *(_t119 + 0x14) & 0x0000ffff;
					if(_t140 >= _t105) {
						_t140 = _t105 & 0x0000ffff;
					}
					 *(_t119 + 0x14) = _t140;
					_t141 = _t105 + _t105;
					_t142 = _t141 & 0x0000001f;
					_t176 = 3;
					_t178 =  !(_t176 << _t142);
					_t108 =  *(_t119 + (_t141 >> 5) * 4 + 0x20);
					do {
						asm("lock cmpxchg [ebx], edx");
					} while ((_t108 & _t178) != 0);
					if((_t108 >> _t142 & 0x00000001) != 0) {
						_t119 = _v16;
						_t172 = 0;
						if( *((char*)(_t119 + 0x1d)) > 1) {
							_t112 = E047FD864(_t119, _a4 - _t119, _t182 & 0x0000ffff, 0,  &_v32);
							_t184 = _t112;
							if(_t112 != 0xffffffff) {
								asm("lock xadd [ecx], edx");
								E047FD8DF(_v20, _t119, _t184, 2, _a8);
							}
						}
						goto L14;
					}
					_push(_t142);
					_push(_v12);
					E047FA80D( *_v20, 0x11, _a4, _v16);
					_t172 = 0;
				}
			}

0x047fdbdc
0x047fdbde
0x047fdbe1
0x047fdbed
0x047fdbef
0x047fdbf7
0x047fdbfd
0x047fdc00
0x047fdc04
0x047fdc07
0x047fdc0c
0x047fdd1f
0x047fdd1f
0x047fdd23
0x047fdd26
0x047fdd29
0x047fdd29
0x047fdd2c
0x047fdd32
0x047fdd35
0x00000000
0x047fdd38
0x047fdd3a
0x047fdd5d
0x047fdd63
0x047fdd69
0x047fdd6e
0x047fdd71
0x047fdd78
0x047fdd7d
0x047fdd8c
0x047fdd9e
0x047fdda0
0x047fddad
0x047fddb0
0x047fddb5
0x047fddb9
0x047fddd9
0x047fddd9
0x047fddde
0x047fdde0
0x047fdde3
0x047fdde5
0x047fdde9
0x047fdde9
0x047fddee
0x047fddf6
0x047fddf6
0x047fdd97
0x00000000
0x00000000
0x047fdd9b
0x00000000
0x047fdd9b
0x047fdd7f
0x00000000
0x047fdd7f
0x047fdd3f
0x047fdd54
0x047fdd58
0x047fdd86
0x00000000
0x047fdd86
0x00000000
0x047fdd5a
0x047fdd5a
0x047fdd5a
0x00000000
0x047fdd5a
0x047fdd3f
0x047fdd38
0x047fdc12
0x047fdc15
0x047fdc25
0x047fdc31
0x047fdc34
0x047fdc3b
0x047fdc3e
0x047fdc40
0x047fdc43
0x047fdc46
0x047fdc62
0x047fdc6b
0x047fdc6d
0x047fdc48
0x047fdc4b
0x047fdc59
0x047fdc5c
0x047fdc5c
0x047fdc72
0x047fdc78
0x047fdc7f
0x047fdc81
0x047fdc81
0x047fdc84
0x047fdc88
0x047fdc8d
0x047fdc95
0x047fdc9b
0x047fdca0
0x047fdca2
0x047fdca6
0x047fdca6
0x047fdcb0
0x047fdcd1
0x047fdcd4
0x047fdcda
0x047fdcec
0x047fdcf1
0x047fdcf6
0x047fdd0c
0x047fdd1a
0x047fdd1a
0x047fdcf6
0x00000000
0x047fdcda
0x047fdcb5
0x047fdcb6
0x047fdcc5
0x047fdcca
0x047fdcca

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbe5ac6fe50e9f3756055196e14957f251c306a7e0294398ef3ea930b70a9837
Instruction ID: f31b2a49dc674e37e96705de1b9e2d73b08cc73a1d3ebd8919b67e11f5dcd4e3
Opcode Fuzzy Hash: fbe5ac6fe50e9f3756055196e14957f251c306a7e0294398ef3ea930b70a9837
Instruction Fuzzy Hash: 4E712975E001299FDB24DF69CC80ABEB7F1EF88314B108169E956EB344D634E945DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 047CB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E047CB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0x4827b9c; // 0x0
				_t124 = L04754620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E04779800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E047795B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E047795D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L047577F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E04779910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E047795D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0x4827b9c; // 0x0
									_t92 = L04754620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E04779910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E0473A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E047CE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E047CE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E047795B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x047cb8d9
0x047cb8e4
0x00000000
0x047cb8e6
0x047cb8f3
0x047cb8f5
0x047cb8f5
0x047cb8f8
0x047cb920
0x047cb924
0x047cb936
0x047cb939
0x047cb93d
0x047cb948
0x047cb9a0
0x047cb9a0
0x047cb9a4
0x047cb9bf
0x047cb9c4
0x047cb9c6
0x047cb9cd
0x047cb9d1
0x047cbad4
0x047cbad8
0x047cbada
0x047cbadc
0x047cbadc
0x047cbadf
0x047cbae0
0x047cbae2
0x047cbae4
0x047cbaec
0x047cbaee
0x047cbaf0
0x047cbaf0
0x047cbaec
0x047cbafb
0x047cbafc
0x047cbafe
0x047cbb01
0x047cbb01
0x00000000
0x047cbb06
0x047cb9d7
0x047cb9db
0x047cb9db
0x047cb9de
0x047cb9de
0x047cb9e4
0x047cb9e7
0x047cb9ea
0x047cb9ec
0x047cb9ef
0x047cb9f3
0x047cba1b
0x047cba1b
0x047cba23
0x047cba24
0x047cba27
0x047cba2a
0x047cba2b
0x047cba2e
0x047cba30
0x047cba37
0x047cba3f
0x047cba9c
0x047cbaa2
0x047cbb13
0x047cbb15
0x047cbaae
0x047cbaae
0x047cbab3
0x047cbab5
0x047cbaba
0x047cbac8
0x047cbac8
0x047cbaba
0x047cbacd
0x047cbacf
0x00000000
0x047cbacf
0x047cbb1a
0x00000000
0x047cbb1c
0x047cbaa7
0x047cbb11
0x00000000
0x047cbb11
0x047cbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x047cba41
0x047cba41
0x047cba41
0x047cba58
0x047cba5d
0x047cba62
0x00000000
0x00000000
0x047cba64
0x047cba67
0x047cba68
0x047cba69
0x047cba6c
0x047cba6f
0x047cba71
0x047cba78
0x047cba80
0x00000000
0x00000000
0x047cba90
0x047cba90
0x047cba97
0x00000000
0x047cba97
0x047cb9f5
0x047cb9f7
0x047cb9f7
0x047cb9fa
0x047cba03
0x047cba07
0x047cba0c
0x047cba10
0x047cba17
0x00000000
0x047cb9f7
0x047cb9a6
0x047cb9a8
0x047cb9af
0x047cb9b3
0x00000000
0x00000000
0x047cb9b9
0x00000000
0x047cb9b9
0x047cb94d
0x047cb98f
0x047cb995
0x047cb999
0x047cb960
0x047cb967
0x047cb968
0x047cb96a
0x00000000
0x047cb96a
0x047cb99b
0x047cb99e
0x00000000
0x00000000
0x00000000
0x047cb99e
0x047cb951
0x047cb954
0x047cb95a
0x047cb95e
0x047cb972
0x047cb979
0x047cb97d
0x047cb97f
0x047cb980
0x047cb982
0x047cb984
0x00000000
0x047cb984
0x00000000
0x047cb926
0x00000000
0x047cb926

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a15ae328307a731a01ffa72283a269c6df0f2c5940c5f8aa9d50203eb43eb91
Instruction ID: f87e45418489ed91bec13c96f538446555a5a9d8b3fcca696bbebe54d4a4ef5d
Opcode Fuzzy Hash: 3a15ae328307a731a01ffa72283a269c6df0f2c5940c5f8aa9d50203eb43eb91
Instruction Fuzzy Hash: 50710E72240701EFEB318F25D84AF5ABBA5EB40724F10492CF6958B3A1EB75F940DB40

Uniqueness

Uniqueness Score: -1.00%

Function 047B6DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E047B6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E047B6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E04757D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E04779AE0();
					_t87 = L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E047B795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E047B795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E047B795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E047B795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L04754620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E047B6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E047B6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E047B6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E047B6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E04757D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E04779AE0();
								L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L04752400( &_v36);
							if(_v24 >= 0) {
								_t87 = L04752400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L04752400( &_v52);
							}
							if(_v28 >= 0) {
								return L04752400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x047b6dd4
0x047b6dde
0x047b6de1
0x047b6de3
0x047b6de6
0x047b6de9
0x047b6dec
0x047b6def
0x047b6df2
0x047b6df5
0x047b6dfe
0x047b6e04
0x047b6e09
0x047b6e0d
0x047b6e18
0x047b6e1b
0x047b6e22
0x047b6e2d
0x047b6e30
0x047b6e36
0x047b6e42
0x047b6e4d
0x047b6e50
0x047b6e55
0x047b6e5c
0x047b6e6e
0x047b6e5e
0x047b6e67
0x047b6e67
0x047b6e73
0x047b6e74
0x047b6e77
0x047b6e7c
0x047b6e7d
0x047b6e8e
0x047b6e93
0x047b6e9c
0x047b6ea8
0x047b6eab
0x047b6eac
0x047b6eb3
0x047b6ecd
0x047b6edc
0x047b6ee2
0x047b6ee5
0x047b6ef2
0x047b6efb
0x047b6f01
0x047b6f06
0x047b6f0b
0x047b6f11
0x047b6f1a
0x047b6f22
0x047b6f26
0x047b6f26
0x047b6f33
0x047b6f41
0x047b6f44
0x047b6f47
0x047b6f54
0x047b6f65
0x047b6f77
0x047b6f7c
0x047b6f82
0x047b6f91
0x047b6f99
0x047b6fa3
0x047b6fae
0x047b6fae
0x047b6fba
0x047b6fbb
0x047b6fbc
0x047b6fc1
0x047b6fc2
0x047b6fd3
0x047b6fd8
0x047b6fd8
0x047b6fdf
0x047b6fe8
0x047b6fee
0x047b6fee
0x047b6ff5
0x047b6ffb
0x047b6ffb
0x047b7004
0x00000000
0x047b700a
0x047b7004
0x047b6eb3
0x047b6e9c
0x047b7015

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: b92faedb14843a7c3bc4f3c09a74b2b73f68a3926cd8036c4f1d2dd0d9e872c0
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: CC716C71A00609AFDB14DFA5C984FEEBBB9FF88714F104469E945AB350DB30BA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 047F1002, Relevance: .2, Instructions: 198
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E047F1002(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _t75;
				intOrPtr* _t76;
				signed int _t77;
				signed short _t78;
				signed short _t80;
				signed int _t81;
				signed short _t82;
				signed short _t83;
				signed short _t85;
				signed int _t86;
				void* _t90;
				signed short _t91;
				signed int _t95;
				signed short _t97;
				signed short _t99;
				intOrPtr* _t101;
				signed short _t102;
				signed int _t103;
				signed short _t105;
				intOrPtr _t106;
				signed int* _t108;
				signed short _t109;
				signed short _t111;
				signed short _t112;
				signed int _t113;
				signed short _t117;
				signed int _t120;
				void* _t121;
				signed int _t122;
				signed int _t126;
				signed int* _t127;
				signed short _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				signed int _t132;
				signed int _t133;

				_t121 = __edx;
				_t130 = __ecx;
				_v16 = __ecx;
				_t108 = __ecx + 0xa4;
				_t75 =  *_t108;
				L4:
				L4:
				if(_t75 != _t108) {
					goto L1;
				} else {
					_t127 = _t130 + 0x9c;
					_t120 =  *_t127;
				}
				while(_t120 != _t127) {
					_t132 = _t120 & 0xffff0000;
					__eflags = _t132 - _t121;
					if(_t132 <= _t121) {
						_t75 =  *((intOrPtr*)(_t120 + 0x14)) + _t132;
						__eflags = _t75 - _t121;
						if(_t75 > _t121) {
							 *0x4825898 = 5;
						}
					}
					_t120 =  *_t120;
				}
				L68:
				return _t75;
				L1:
				_t3 = _t75 - 0x10; // -16
				_t126 = _t3;
				_v20 = _t126;
				__eflags =  *((intOrPtr*)(_t126 + 0x1c)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x1c)) > _t121) {
					L3:
					_t75 =  *_t75;
					goto L4;
				}
				__eflags =  *((intOrPtr*)(_t126 + 0x28)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x28)) > _t121) {
					_t8 = _t126 + 0x38; // 0x28
					_t101 = _t8;
					_t109 = 0;
					_v8 = _v8 & 0;
					_t76 =  *_t101;
					_v12 = _t101;
					__eflags = _t76 - _t101;
					if(_t76 == _t101) {
						L17:
						_t102 = 0;
						_v20 = 0;
						__eflags = _t109;
						if(_t109 == 0) {
							_t109 = _t126;
						}
						_t128 = 0;
						__eflags = _t109 - _t121;
						if(_t109 >= _t121) {
							L29:
							_t111 = _v8 + 0xfffffff8;
							__eflags = _t111 - _t121;
							if(_t111 <= _t121) {
								L33:
								 *0x48258b0 = _t128;
								 *0x48258b4 = _t102;
								__eflags = _t128;
								if(_t128 == 0) {
									L42:
									__eflags =  *(_t130 + 0x4c);
									if( *(_t130 + 0x4c) == 0) {
										_t77 =  *_t128 & 0x0000ffff;
										_t112 = 0;
										__eflags = 0;
									} else {
										_t85 =  *_t128;
										_t112 =  *(_t130 + 0x4c);
										__eflags = _t85 & _t112;
										if((_t85 & _t112) != 0) {
											_t85 = _t85 ^  *(_t130 + 0x50);
											__eflags = _t85;
										}
										_t77 = _t85 & 0x0000ffff;
									}
									_v8 = _t77;
									__eflags = _t102;
									if(_t102 != 0) {
										_t117 =  *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t117;
										 *0x48258b8 = _t117;
										_t112 =  *(_t130 + 0x4c);
									}
									__eflags = _t112;
									if(_t112 == 0) {
										_t78 =  *_t128 & 0x0000ffff;
									} else {
										_t83 =  *_t128;
										__eflags =  *(_t130 + 0x4c) & _t83;
										if(( *(_t130 + 0x4c) & _t83) != 0) {
											_t83 = _t83 ^  *(_t130 + 0x50);
											__eflags = _t83;
										}
										_t78 = _t83 & 0x0000ffff;
									}
									_t122 = _t78 & 0x0000ffff;
									 *0x48258bc = _t122;
									__eflags =  *(_t130 + 0x4c);
									_t113 = _v8 & 0x0000ffff;
									if( *(_t130 + 0x4c) == 0) {
										_t80 =  *(_t128 + _t113 * 8) & 0x0000ffff;
									} else {
										_t82 =  *(_t128 + _t113 * 8);
										__eflags =  *(_t130 + 0x4c) & _t82;
										if(( *(_t130 + 0x4c) & _t82) != 0) {
											_t82 = _t82 ^  *(_t130 + 0x50);
											__eflags = _t82;
										}
										_t122 =  *0x48258bc; // 0x0
										_t80 = _t82 & 0x0000ffff;
									}
									_t81 = _t80 & 0x0000ffff;
									__eflags =  *0x48258b8 - _t81; // 0x0
									if(__eflags == 0) {
										_t75 =  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t122 - ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75);
										if(_t122 == ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75)) {
											goto L68;
										}
										 *0x4825898 = 7;
										return _t75;
									} else {
										 *0x4825898 = 6;
										return _t81;
									}
								}
								__eflags = _t102;
								if(_t102 == 0) {
									goto L42;
								}
								__eflags =  *(_t130 + 0x4c);
								if( *(_t130 + 0x4c) == 0) {
									_t86 =  *_t128 & 0x0000ffff;
								} else {
									_t91 =  *_t128;
									__eflags =  *(_t130 + 0x4c) & _t91;
									if(( *(_t130 + 0x4c) & _t91) != 0) {
										_t91 = _t91 ^  *(_t130 + 0x50);
										__eflags = _t91;
									}
									_t86 = _t91 & 0x0000ffff;
								}
								_v8 = _t86;
								_t90 = _t128 + (_v8 & 0x0000ffff) * 8;
								__eflags = _t90 - _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3);
								if(_t90 == _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3)) {
									goto L42;
								} else {
									 *0x4825898 = 4;
									return _t90;
								}
							}
							_v20 =  *(_t130 + 0x54) & 0x0000ffff;
							while(1) {
								_t102 = _t111;
								_t95 = ( *(_t111 + 4) ^ _v20) & 0x0000ffff;
								__eflags = _t95;
								if(_t95 == 0) {
									goto L33;
								}
								_t111 = _t111 + _t95 * 0xfffffff8;
								__eflags = _t111 - _t121;
								if(_t111 > _t121) {
									continue;
								}
								goto L33;
							}
							goto L33;
						} else {
							_t103 =  *(_t130 + 0x4c);
							while(1) {
								_t128 = _t109;
								__eflags = _t103;
								if(_t103 == 0) {
									_t97 =  *_t109 & 0x0000ffff;
								} else {
									_t99 =  *_t109;
									_t103 =  *(_t130 + 0x4c);
									__eflags = _t99 & _t103;
									if((_t99 & _t103) != 0) {
										_t99 = _t99 ^  *(_t130 + 0x50);
										__eflags = _t99;
									}
									_t97 = _t99 & 0x0000ffff;
								}
								__eflags = _t97;
								if(_t97 == 0) {
									break;
								}
								_t109 = _t109 + (_t97 & 0x0000ffff) * 8;
								__eflags = _t109 - _t121;
								if(_t109 < _t121) {
									continue;
								}
								break;
							}
							_t102 = _v20;
							goto L29;
						}
					}
					_t133 = _v8;
					do {
						_t105 =  *((intOrPtr*)(_t76 + 0xc)) +  *((intOrPtr*)(_t76 + 8));
						_t129 = _v12;
						__eflags = _t105 - _t121;
						if(_t105 < _t121) {
							__eflags = _t105 - _t109;
							if(_t105 > _t109) {
								_t109 = _t105;
							}
						}
						_t106 =  *((intOrPtr*)(_t76 + 8));
						__eflags = _t106 - _t121;
						if(_t106 > _t121) {
							__eflags = _t133;
							if(_t133 == 0) {
								L14:
								_t18 = _t76 - 8; // -8
								_t133 = _t18;
								goto L15;
							}
							__eflags = _t106 -  *((intOrPtr*)(_t133 + 0x10));
							if(_t106 >=  *((intOrPtr*)(_t133 + 0x10))) {
								goto L15;
							}
							goto L14;
						}
						L15:
						_t76 =  *_t76;
						__eflags = _t76 - _t129;
					} while (_t76 != _t129);
					_t126 = _v20;
					_v8 = _t133;
					_t130 = _v16;
					goto L17;
				}
				goto L3;
			}

0x047f1002
0x047f100c
0x047f100f
0x047f1012
0x047f1018
0x00000000
0x047f102e
0x047f1030
0x00000000
0x047f1032
0x047f1032
0x047f1038
0x047f1038
0x047f121e
0x047f11ff
0x047f1205
0x047f1207
0x047f120c
0x047f120e
0x047f1210
0x047f1212
0x047f1212
0x047f1210
0x047f121c
0x047f121c
0x047f1228
0x047f1228
0x047f101c
0x047f101c
0x047f101c
0x047f101f
0x047f1022
0x047f1025
0x047f102c
0x047f102c
0x00000000
0x047f102c
0x047f1027
0x047f102a
0x047f103f
0x047f103f
0x047f1042
0x047f1044
0x047f1047
0x047f1049
0x047f104c
0x047f104e
0x047f1088
0x047f1088
0x047f108a
0x047f108d
0x047f108f
0x047f1091
0x047f1091
0x047f1093
0x047f1095
0x047f1097
0x047f10c8
0x047f10cb
0x047f10ce
0x047f10d0
0x047f10f4
0x047f10f4
0x047f10fa
0x047f1100
0x047f1102
0x047f1150
0x047f1150
0x047f1154
0x047f1167
0x047f116a
0x047f116a
0x047f1156
0x047f1156
0x047f1158
0x047f115b
0x047f115d
0x047f115f
0x047f115f
0x047f115f
0x047f1162
0x047f1162
0x047f116c
0x047f116f
0x047f1171
0x047f117b
0x047f117b
0x047f117d
0x047f1183
0x047f1183
0x047f1186
0x047f1188
0x047f1199
0x047f118a
0x047f118a
0x047f118c
0x047f118f
0x047f1191
0x047f1191
0x047f1191
0x047f1194
0x047f1194
0x047f119c
0x047f11a2
0x047f11a8
0x047f11ac
0x047f11af
0x047f11c7
0x047f11b1
0x047f11b1
0x047f11b4
0x047f11b7
0x047f11b9
0x047f11b9
0x047f11b9
0x047f11bc
0x047f11c2
0x047f11c2
0x047f11cb
0x047f11ce
0x047f11d4
0x047f11e7
0x047f11ed
0x047f11ef
0x00000000
0x00000000
0x047f11f1
0x00000000
0x047f11d6
0x047f11d6
0x00000000
0x047f11d6
0x047f11d4
0x047f1104
0x047f1106
0x00000000
0x00000000
0x047f1108
0x047f110c
0x047f111d
0x047f110e
0x047f110e
0x047f1110
0x047f1113
0x047f1115
0x047f1115
0x047f1115
0x047f1118
0x047f1118
0x047f1126
0x047f113a
0x047f113d
0x047f113f
0x00000000
0x047f1141
0x047f1141
0x00000000
0x047f1141
0x047f113f
0x047f10d6
0x047f10d9
0x047f10dd
0x047f10e3
0x047f10e6
0x047f10e9
0x00000000
0x00000000
0x047f10ee
0x047f10f0
0x047f10f2
0x00000000
0x00000000
0x00000000
0x047f10f2
0x00000000
0x047f1099
0x047f1099
0x047f109c
0x047f109c
0x047f109e
0x047f10a0
0x047f10b3
0x047f10a2
0x047f10a2
0x047f10a4
0x047f10a7
0x047f10a9
0x047f10ab
0x047f10ab
0x047f10ab
0x047f10ae
0x047f10ae
0x047f10b6
0x047f10b9
0x00000000
0x00000000
0x047f10be
0x047f10c1
0x047f10c3
0x00000000
0x00000000
0x00000000
0x047f10c3
0x047f10c5
0x00000000
0x047f10c5
0x047f1097
0x047f1050
0x047f1053
0x047f1056
0x047f1059
0x047f105c
0x047f105e
0x047f1060
0x047f1062
0x047f1064
0x047f1064
0x047f1062
0x047f1066
0x047f1069
0x047f106b
0x047f106d
0x047f106f
0x047f1076
0x047f1076
0x047f1076
0x00000000
0x047f1076
0x047f1071
0x047f1074
0x00000000
0x00000000
0x00000000
0x047f1074
0x047f1079
0x047f1079
0x047f107b
0x047f107b
0x047f107f
0x047f1082
0x047f1085
0x00000000
0x047f1085
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ff26895f6d93048a5e668728e18065067044a9cda0688088690a05477c4f15e
Instruction ID: c4cc9937b07d4ca1dd509d49cce3b411b00980dbeff72316cf870892fda9d61f
Opcode Fuzzy Hash: 7ff26895f6d93048a5e668728e18065067044a9cda0688088690a05477c4f15e
Instruction Fuzzy Hash: B0717B34A00662DBCB24CF5AC99067AB3F1FB44311FA4486EEA829B741E776BD50DB50

Uniqueness

Uniqueness Score: -1.00%

Function 047352A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E047352A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E0474EEF0(0x48279a0);
					_t104 =  *0x4828210; // 0x802d20
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					_t2 = _t104 + 8; // 0x2e000000
					 *((intOrPtr*)(_t108 + 0x18)) =  *_t2;
					E0474EB70(_t93, 0x48279a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_t10 = _t104 + 4; // 0x0
							_push( *_t10);
							_t53 = E04779890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E0474EEF0(0x48279a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E0474EB70(0, 0x48279a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t11 = _t104 + 0xe; // 0x802d3802
								_t13 = _t104 + 0xc; // 0x802d2d
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E0476F0BF(_t13,  *_t11 & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E0474EEF0(0x48279a0);
									__eflags =  *0x4828210 - _t104; // 0x802d20
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0x4828210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t37 = _t104 + 0x10; // 0x2000802d
											_t95 =  *((intOrPtr*)( *_t37));
											E047B4888(_t89,  *((intOrPtr*)( *_t37)), __eflags);
										}
										E0474EB70(_t95, 0x48279a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_t38 = _t104 + 4; // 0x0
											_push( *_t38);
											E047795D0();
											L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_t41 = _t104 + 4; // 0x0
											_push( *_t41);
											E047795D0();
											L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E0474EB70(_t93, 0x48279a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_t25 = _t104 + 4; // 0x0
										_push( *_t25);
										E047795D0();
										L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E047795D0();
										L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t15 = _t104 + 0x10; // 0x2000802d
								_t93 =  &_v20;
								_t17 = _t104 + 0xe; // 0x802d3802
								 *((intOrPtr*)(_t108 + 0x20)) =  *_t15;
								_t85 = 6;
								_v20 = _t85;
								_t87 = E0476F0BF( &_v20,  *_t17 & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x047352a5
0x047352ad
0x047352b0
0x047352b3
0x047352b7
0x047352ba
0x047352bf
0x047352c4
0x047352cc
0x00000000
0x00000000
0x047352ce
0x047352d1
0x047352d9
0x047352dd
0x047352e7
0x047352f7
0x047352f9
0x047352fd
0x04790dcf
0x04790dd5
0x04790dd6
0x04790dd7
0x04790dd8
0x04790dd9
0x04790dde
0x04790ddf
0x04790de0
0x04790de1
0x04790de2
0x04790de2
0x04790de5
0x04790dea
0x04790dec
0x04790f60
0x04790f64
0x04790f70
0x04790f76
0x04790f79
0x04790f79
0x00000000
0x04790f64
0x04790df2
0x04790df7
0x04790e04
0x04790e04
0x04790e0d
0x04790e0d
0x04790e10
0x04790e1a
0x04790e1c
0x04790e4c
0x04790e52
0x04790e61
0x04790e67
0x04790e6b
0x04790e70
0x04790e76
0x04790ed7
0x04790edc
0x04790ee0
0x04790ee6
0x04790eea
0x04790eed
0x04790ef0
0x04790ef3
0x04790ef6
0x04790ef9
0x04790efb
0x04790efe
0x04790f01
0x04790f01
0x04790f0b
0x04790f12
0x04790f16
0x04790f18
0x04790f18
0x04790f1b
0x04790f2c
0x04790f31
0x04790f31
0x04790f35
0x04790f39
0x04790f3a
0x04790f3c
0x04790f3c
0x04790f3f
0x04790f50
0x04790f55
0x04790f55
0x04790f59
0x047352eb
0x047352f1
0x047352f1
0x04790e7d
0x04790e84
0x04790e88
0x04790e8a
0x04790e8a
0x04790e8d
0x04790e9e
0x04790ea3
0x04790ea3
0x04790ea7
0x04790eaf
0x04790eb3
0x04790eb9
0x04790eb9
0x04790ebc
0x04790ecd
0x04790ecd
0x00000000
0x04790eb3
0x04790e1e
0x04790e21
0x04790e25
0x04790e2b
0x04790e2f
0x04790e30
0x04790e3a
0x04790e3f
0x04790e41
0x00000000
0x00000000
0x04790e47
0x00000000
0x04790e47
0x04790df9
0x04790dfe
0x00000000
0x00000000
0x00000000
0x04790dfe
0x04735303
0x04735307
0x00000000
0x04735309
0x00000000
0x04735309
0x04735307
0x047352e9
0x047352e9
0x00000000
0x047352e9
0x0473530e
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27ef377b5e74c1a8aaf0b89dab1a5b5a777ee54957889f5dc4c623b3ddce3b0
Instruction ID: b1e970bf14c6d89c2f9859262e462ab97c66342922740d198baa6ce88a82d7b3
Opcode Fuzzy Hash: f27ef377b5e74c1a8aaf0b89dab1a5b5a777ee54957889f5dc4c623b3ddce3b0
Instruction Fuzzy Hash: BC51FCB0205792AFEB21EF68CA44B27BBE4FF84714F14491AE89587751E774F840CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04762AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04762AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0x4828204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0x4828208; // 0x4828207
				_t8 = _t57 + 0x4828208; // 0x4828207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0x4828450; // 0x8017ca
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0x482821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0x4826d5c; // 0x7fa60654
							_t72 =  *0x4826d5c; // 0x7fa60654
							_t75 =  *0x4826d5c; // 0x7fa60654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0x4826d5c; // 0x7fa60654
							_t84 =  *0x4826d5c; // 0x7fa60654
							_t87 =  *0x4826d5c; // 0x7fa60654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E0477F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x04762ae4
0x04762aec
0x04762aef
0x04762af4
0x04762af7
0x04762afd
0x04762b92
0x04762b92
0x04762b97
0x04762b9c
0x04762b9c
0x04762b03
0x04762b06
0x04762b09
0x04762b09
0x04762b0f
0x04762b15
0x04762b15
0x04762b1b
0x04762b1e
0x04762b21
0x04762b26
0x04762b29
0x04762b81
0x04762b84
0x04762c0e
0x04762c15
0x04762c24
0x04762c24
0x04762b8a
0x04762b8a
0x04762b8a
0x04762b8a
0x04762b90
0x00000000
0x00000000
0x00000000
0x00000000
0x04762b4a
0x04762b4a
0x04762b4d
0x04762b53
0x00000000
0x00000000
0x04762b55
0x04762b58
0x04762bb7
0x047a5d1b
0x047a5d37
0x047a5d47
0x047a5d53
0x04762bbd
0x04762bbd
0x04762bbd
0x04762bb7
0x04762b5d
0x04762c2f
0x047a5d5b
0x047a5d77
0x047a5d87
0x047a5d93
0x04762c35
0x04762c35
0x04762c35
0x04762c2f
0x04762b65
0x04762b9f
0x04762ba2
0x04762b67
0x04762b67
0x04762b69
0x04762b6b
0x04762b6e
0x04762bc9
0x04762bcc
0x04762bcf
0x04762bd4
0x04762bd6
0x04762bd6
0x04762bdb
0x04762c02
0x04762c05
0x04762c07
0x00000000
0x04762c07
0x04762be0
0x04762c00
0x04762c3f
0x04762c3f
0x00000000
0x04762c00
0x04762be5
0x04762be7
0x04762bec
0x04762bf4
0x04762bf6
0x00000000
0x04762bf6
0x04762b70
0x04762b76
0x04762b2b
0x04762b2b
0x04762b2d
0x04762b2f
0x04762b32
0x04762b35
0x04762b3a
0x00000000
0x04762b40
0x04762b43
0x04762b45
0x04762b47
0x04762b4a
0x04762b4d
0x04762b53
0x00000000
0x00000000
0x00000000
0x04762b53
0x04762b78
0x04762b78
0x04762b7b
0x04762b7e
0x00000000
0x04762b7e
0x04762b76
0x04762ba5
0x04762ba5
0x04762ba8
0x04762bad
0x00000000
0x00000000
0x04762baf
0x04762baf
0x04762bc2
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46adf60bbcbab490cc4821e8773a090204d037d13f631cc0f5e435647a1d5bca
Instruction ID: abca184bc313c229f99c4e3d7d5a239ca5af1826dbd090e5200126055375d075
Opcode Fuzzy Hash: 46adf60bbcbab490cc4821e8773a090204d037d13f631cc0f5e435647a1d5bca
Instruction Fuzzy Hash: F451B076B00115CBCB54EF19C8809BDB7B6FB88700715899AEC4AAB312F735BE50DB90

Uniqueness

Uniqueness Score: -1.00%

Function 047FAE44, Relevance: .2, Instructions: 152
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E047FAE44(signed char __ecx, signed int __edx, signed int _a4, signed char _a8, signed int* _a12) {
				signed int _v8;
				signed int _v12;
				void* __esi;
				void* __ebp;
				signed short* _t36;
				signed int _t41;
				char* _t42;
				intOrPtr _t43;
				signed int _t47;
				void* _t52;
				signed int _t57;
				intOrPtr _t61;
				signed char _t62;
				signed int _t72;
				signed char _t85;
				signed int _t88;

				_t73 = __edx;
				_push(__ecx);
				_t85 = __ecx;
				_v8 = __edx;
				_t61 =  *((intOrPtr*)(__ecx + 0x28));
				_t57 = _a4 |  *(__ecx + 0xc) & 0x11000001;
				if(_t61 != 0 && _t61 ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
					_t57 = _t57 | 0x00000001;
				}
				_t88 = 0;
				_t36 = 0;
				_t96 = _a12;
				if(_a12 == 0) {
					_t62 = _a8;
					__eflags = _t62;
					if(__eflags == 0) {
						goto L12;
					}
					_t52 = E047FC38B(_t85, _t73, _t57, 0);
					_t62 = _a8;
					 *_t62 = _t52;
					_t36 = 0;
					goto L11;
				} else {
					_t36 = E047FACFD(_t85, _t73, _t96, _t57, _a8);
					if(0 == 0 || 0 == 0xffffffff) {
						_t72 = _t88;
					} else {
						_t72 =  *0x00000000 & 0x0000ffff;
					}
					 *_a12 = _t72;
					_t62 = _a8;
					L11:
					_t73 = _v8;
					L12:
					if((_t57 & 0x01000000) != 0 ||  *((intOrPtr*)(_t85 + 0x20)) == _t88) {
						L19:
						if(( *(_t85 + 0xc) & 0x10000000) == 0) {
							L22:
							_t74 = _v8;
							__eflags = _v8;
							if(__eflags != 0) {
								L25:
								__eflags = _t88 - 2;
								if(_t88 != 2) {
									__eflags = _t85 + 0x44 + (_t88 << 6);
									_t88 = E047FFDE2(_t85 + 0x44 + (_t88 << 6), _t74, _t57);
									goto L34;
								}
								L26:
								_t59 = _v8;
								E047FEA55(_t85, _v8, _t57);
								asm("sbb esi, esi");
								_t88 =  ~_t88;
								_t41 = E04757D50();
								__eflags = _t41;
								if(_t41 == 0) {
									_t42 = 0x7ffe0380;
								} else {
									_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
								}
								__eflags =  *_t42;
								if( *_t42 != 0) {
									_t43 =  *[fs:0x30];
									__eflags =  *(_t43 + 0x240) & 0x00000001;
									if(( *(_t43 + 0x240) & 0x00000001) != 0) {
										__eflags = _t88;
										if(_t88 != 0) {
											E047F1608(_t85, _t59, 3);
										}
									}
								}
								goto L34;
							}
							_push(_t62);
							_t47 = E04801536(0x4828ae4, (_t74 -  *0x4828b04 >> 0x14) + (_t74 -  *0x4828b04 >> 0x14), _t88, __eflags);
							__eflags = _t47;
							if(_t47 == 0) {
								goto L26;
							}
							_t74 = _v12;
							_t27 = _t47 - 1; // -1
							_t88 = _t27;
							goto L25;
						}
						_t62 = _t85;
						if(L047FC323(_t62, _v8, _t57) != 0xffffffff) {
							goto L22;
						}
						_push(_t62);
						_push(_t88);
						E047FA80D(_t85, 9, _v8, _t88);
						goto L34;
					} else {
						_t101 = _t36;
						if(_t36 != 0) {
							L16:
							if(_t36 == 0xffffffff) {
								goto L19;
							}
							_t62 =  *((intOrPtr*)(_t36 + 2));
							if((_t62 & 0x0000000f) == 0) {
								goto L19;
							}
							_t62 = _t62 & 0xf;
							if(E047DCB1E(_t62, _t85, _v8, 3, _t36 + 8) < 0) {
								L34:
								return _t88;
							}
							goto L19;
						}
						_t62 = _t85;
						_t36 = E047FACFD(_t62, _t73, _t101, _t57, _t62);
						if(_t36 == 0) {
							goto L19;
						}
						goto L16;
					}
				}
			}

0x047fae44
0x047fae4c
0x047fae53
0x047fae55
0x047fae5c
0x047fae64
0x047fae68
0x047fae75
0x047fae75
0x047fae78
0x047fae7a
0x047fae7c
0x047fae7f
0x047faea8
0x047faeab
0x047faead
0x00000000
0x00000000
0x047faeb3
0x047faeb8
0x047faebb
0x047faebd
0x00000000
0x047fae81
0x047fae88
0x047fae8f
0x047fae9b
0x047fae96
0x047fae96
0x047fae96
0x047faea0
0x047faea3
0x047faebf
0x047faebf
0x047faec3
0x047faec9
0x047faf0d
0x047faf14
0x047faf3d
0x047faf3d
0x047faf41
0x047faf44
0x047faf67
0x047faf67
0x047faf6a
0x047fafca
0x047fafd1
0x00000000
0x047fafd1
0x047faf6c
0x047faf6d
0x047faf75
0x047faf7c
0x047faf7e
0x047faf80
0x047faf85
0x047faf87
0x047faf99
0x047faf89
0x047faf92
0x047faf92
0x047faf9e
0x047fafa1
0x047fafa3
0x047fafa9
0x047fafb0
0x047fafb2
0x047fafb4
0x047fafbc
0x047fafbc
0x047fafb4
0x047fafb0
0x00000000
0x047fafa1
0x047faf4f
0x047faf57
0x047faf5c
0x047faf5e
0x00000000
0x00000000
0x047faf60
0x047faf64
0x047faf64
0x00000000
0x047faf64
0x047faf1a
0x047faf25
0x00000000
0x00000000
0x047faf27
0x047faf28
0x047faf33
0x00000000
0x047faed0
0x047faed0
0x047faed2
0x047faee1
0x047faee4
0x00000000
0x00000000
0x047faee6
0x047faeec
0x00000000
0x00000000
0x047faefb
0x047faf07
0x047fafd3
0x047fafdb
0x047fafdb
0x00000000
0x047faf07
0x047faed6
0x047faed8
0x047faedf
0x00000000
0x00000000
0x00000000
0x047faedf
0x047faec9

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c6dee4b02369d7d591c33c4f8a8f8f3ca8cf7cece7e9d10da564c541870d13
Instruction ID: a5fed929202e26d54f09a260bad3534e95d8c1aea85facc4dffb7742ccc85260
Opcode Fuzzy Hash: 46c6dee4b02369d7d591c33c4f8a8f8f3ca8cf7cece7e9d10da564c541870d13
Instruction Fuzzy Hash: 8041F5B17002119BDB26DA29CC94F3BB7D9EF84724F048619FA1E8B390DB74F841D691

Uniqueness

Uniqueness Score: -1.00%

Function 0475DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0475DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E0473CC50(E04734510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E04757D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E04808ED6(_t102, _t98);
						}
						_t76 = _v44;
						E04752280(_t58, _v44);
						E0475DD82(_v44, _t102, _t98);
						E0475B944(_t102, _v5);
						return E0474FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0x4828628; // 0x0
							_v28 = _t67;
							_t68 =  *0x482862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0x4828628; // 0x0
						_t105 = _v28;
						_t80 =  *0x482862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0x47ffb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x0475dbe9
0x0475dbf2
0x0475dbf7
0x0475dbf9
0x0475dbfc
0x0475dc00
0x0475dc03
0x0475dc14
0x0475dd54
0x0475dd54
0x0475dd54
0x0475dc18
0x0475dc1d
0x0475dc1d
0x0475dc32
0x0475dc3b
0x0475dc3e
0x0475dc46
0x0475dd5b
0x0475dd62
0x0475dd64
0x0475dd67
0x0475dd69
0x0475dd6b
0x0475dd6e
0x0475dd70
0x0475dd73
0x0475dd73
0x00000000
0x0475dc4c
0x0475dc4e
0x047a3ae3
0x047a3ae8
0x047a3aea
0x0475dce7
0x0475dce9
0x0475dcec
0x0475dcee
0x0475dcf0
0x0475dcf3
0x0475dcf5
0x047a3af2
0x047a3af5
0x047a3af5
0x0475dd06
0x0475dd08
0x0475dd0b
0x0475dd12
0x047a3b08
0x0475dd18
0x0475dd18
0x0475dd18
0x0475dd20
0x0475dd23
0x047a3b16
0x047a3b16
0x0475dd29
0x0475dd2d
0x0475dd36
0x0475dd40
0x0475dd51
0x0475dd51
0x0475dc54
0x0475dc59
0x0475dc59
0x0475dc5e
0x0475dc5e
0x0475dc63
0x0475dc66
0x0475dc6b
0x0475dc78
0x0475dc7b
0x0475dc81
0x0475dc81
0x0475dc83
0x0475dc89
0x00000000
0x00000000
0x0475dd7b
0x0475dd7b
0x0475dc8f
0x0475dc8f
0x0475dc92
0x0475dc99
0x0475dc9f
0x0475dca5
0x0475dcaa
0x0475dcaa
0x0475dcb3
0x0475dcb8
0x0475dcbb
0x0475dcc1
0x0475dccf
0x0475dcd2
0x0475dcd5
0x0475dcd7
0x0475dcda
0x0475dcdc
0x0475dcdc
0x0475dce2
0x0475dce4
0x00000000
0x0475dce4

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 085e4d9f9fd5e80fe1501fea3be3229cd545778a7d1e55c008bee8f84ab7d155
Instruction ID: 97db5f66c4559bb3f102c98e6680e3977b9a808a0992b3573355628e3b06507b
Opcode Fuzzy Hash: 085e4d9f9fd5e80fe1501fea3be3229cd545778a7d1e55c008bee8f84ab7d155
Instruction Fuzzy Hash: 77518F71A01615DFCB24DFA8C580AAEBBF1FB48310F20865AD955AB354EBB1B944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0474EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0474EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E04739080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x775ec21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E04732D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x0474ef4b
0x0474ef4d
0x0474ef57
0x0474f0bd
0x0474f0c2
0x0474f0d2
0x0474f0d2
0x0474f0c2
0x0474ef5d
0x0474ef5f
0x0474ef67
0x0474ef6a
0x0474ef6d
0x0474ef74
0x0474ef7f
0x0474ef82
0x0474ef82
0x0474ef86
0x0474ef88
0x0474ef8c
0x0474ef8f
0x0474ef8f
0x0474ef8f
0x00000000
0x0474ef91
0x0474ef93
0x0474efc4
0x0474efc4
0x0474efc4
0x0474efca
0x0474efd0
0x0474f0a6
0x00000000
0x00000000
0x0474f0af
0x0479bb06
0x0479bb0a
0x0474f0b5
0x0474f0b5
0x0474f0b5
0x0474f0b5
0x00000000
0x0474efd6
0x0474efd9
0x0474f0de
0x0474f0e2
0x0474efdf
0x0474efdf
0x0474efdf
0x0474efe5
0x0479bafc
0x0479bafc
0x0474efe5
0x0474efeb
0x0474efed
0x0474f00f
0x0474f011
0x0474f01a
0x0474f01d
0x0474f021
0x0474f028
0x0474f029
0x0474f029
0x0474f02c
0x00000000
0x0474f02c
0x0474eff3
0x0474eff9
0x0474f0ea
0x0474f0ed
0x0474f0ef
0x00000000
0x0474f0ef
0x0474f003
0x0479bb12
0x0474f045
0x0474f049
0x0474f051
0x0474f09e
0x0474f0a0
0x0474f0a0
0x0474f09e
0x0474f053
0x0474f064
0x0474f064
0x0474f06b
0x0479bb1a
0x0479bb1a
0x0474f071
0x0474f071
0x0474f07d
0x0474f082
0x0474f08f
0x0474f08f
0x0474f009
0x0474f00d
0x00000000
0x0474f00d
0x0474efd0
0x0474ef97
0x0474efa5
0x0474efaa
0x00000000
0x0474efac
0x0474efac
0x0474efac
0x00000000
0x0474efb2
0x0474f036
0x0474f03a
0x0474f040
0x0474f090
0x00000000
0x0474f092
0x0474f042
0x00000000
0x0474f042
0x0474efb7
0x0474efb9
0x0474efbc
0x0474efb0
0x0474efb0
0x00000000
0x0474efbe
0x0474efbe
0x0474efc1
0x00000000
0x0474efc1
0x0474efbc
0x0474efaa
0x0474ef91

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: 9433c05febd21bde4d9e6bdf739dd2da07bd747d68613dd276c4c1a6dec6db91
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: A351ED30A04249DFDB20CF69C180BBEBBB1BFC5324F1885A8C54597392D375B989D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0480740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0480740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E0478D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E0477F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L04754620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L04754620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E0477F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L04754620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x0480740d
0x0480740d
0x04807412
0x04807413
0x04807416
0x04807418
0x0480741c
0x0480741f
0x04807422
0x04807422
0x04807428
0x0480742a
0x0480742a
0x04807451
0x04807432
0x0480744f
0x0480744f
0x00000000
0x04807434
0x04807438
0x04807443
0x04807517
0x04807517
0x0480751a
0x04807535
0x04807520
0x04807527
0x0480752c
0x04807531
0x04807533
0x00000000
0x04807533
0x00000000
0x04807531
0x0480754b
0x0480754f
0x0480755c
0x0480755c
0x0480755f
0x04807560
0x04807561
0x04807562
0x04807563
0x04807568
0x0480756a
0x0480756c
0x0480756d
0x0480756d
0x0480756f
0x04807572
0x04807574
0x04807577
0x0480757c
0x0480757f
0x00000000
0x04807551
0x04807551
0x04807551
0x04807553
0x04807553
0x04807449
0x04807449
0x0480744c
0x0480744c
0x00000000
0x0480744c
0x04807443
0x0480750e
0x04807514
0x04807514
0x04807455
0x04807469
0x0480746d
0x00000000
0x04807473
0x04807473
0x04807476
0x04807480
0x04807484
0x0480748e
0x04807493
0x04807493
0x04807496
0x04807499
0x048074a1
0x048074b1
0x048074b5
0x00000000
0x048074bb
0x048074c1
0x048074c1
0x048074c4
0x048074c5
0x048074c6
0x048074c7
0x048074c8
0x048074cd
0x00000000
0x048074d3
0x048074d3
0x048074d6
0x048074d8
0x048074db
0x048074dd
0x048074e0
0x048074e7
0x048074ee
0x048074ee
0x048074f4
0x048074f9
0x00000000
0x048074fb
0x048074fb
0x048074fd
0x04807500
0x04807503
0x04807505
0x04807505
0x048074f9
0x00000000
0x048074cd
0x048074b5
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 8555fb30f0816e50321a88c355ebdefe4cd015e3051ca335c3d7303d0f1cec10
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: D7517F71600606EFDB55CF14C980A96BBB5FF45308F15C5AAE908DF262E371F946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04762990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E04762990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0x480ff00);
				E0478D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0x4711664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E0477E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0x4711668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E047B51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0x471166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E04762AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E04746600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E04762C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E0474EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E04762AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E04762C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E04762ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E0478D0D1(_t62);
				goto L28;
			}

0x04762990
0x04762992
0x04762997
0x047629a3
0x047629a6
0x047629ab
0x047629ad
0x047629b2
0x047a5c80
0x047629b8
0x047629b8
0x047629bb
0x047629c0
0x047629c5
0x047629c6
0x047629c6
0x047629cb
0x00000000
0x00000000
0x047629cd
0x047629d0
0x047629d9
0x047629db
0x047629dd
0x04762a7f
0x04762a84
0x04762a87
0x04762a89
0x047a5ca1
0x047a5ca3
0x00000000
0x04762a8f
0x04762a8f
0x00000000
0x04762a8f
0x00000000
0x047629e3
0x047629e3
0x047629e3
0x00000000
0x047629e3
0x047629dd
0x00000000
0x047629db
0x047629e6
0x047629e9
0x047629eb
0x047629ed
0x047629f3
0x047629f5
0x047629f8
0x047629fa
0x04762a97
0x04762a9a
0x04762a9d
0x04762add
0x00000000
0x04762a9f
0x04762aa2
0x04762aa5
0x04762aa8
0x04762aab
0x047a5cab
0x047a5caf
0x047a5cc5
0x047a5cda
0x047a5cdc
0x047a5cdf
0x047a5ce5
0x00000000
0x047a5ceb
0x047a5ced
0x047a5cee
0x00000000
0x047a5cee
0x047a5cb1
0x047a5cb4
0x047a5cb9
0x047a5cbb
0x00000000
0x047a5cbd
0x047a5cbd
0x00000000
0x047a5cbd
0x047a5cbb
0x04762ab1
0x04762ab1
0x04762ac4
0x04762ac6
0x04762ac6
0x00000000
0x04762ac6
0x04762aab
0x00000000
0x04762a00
0x04762a09
0x04762a0e
0x04762a21
0x04762a24
0x04762a35
0x04762a3a
0x04762a3d
0x04762a42
0x04762a59
0x04762a59
0x04762a5c
0x04762a5f
0x04762a5f
0x047629fa
0x047629f3
0x04762a64
0x04762a64
0x04762a6b
0x04762a6b
0x04762a6d
0x04762a72
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf0d0d093cb239ee4510ee0a6681c42955b820f7e78323ca0b10d376de8e9660
Instruction ID: 086779e18eb62804a5b4a058fb3d68842b32beb26b51c852f026837ea9450e25
Opcode Fuzzy Hash: cf0d0d093cb239ee4510ee0a6681c42955b820f7e78323ca0b10d376de8e9660
Instruction Fuzzy Hash: 47516971A0020AEFDF65EF55C840AEEBBB2BF48314F008195ED02AB361D775A952DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04764D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E04764D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0x482d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E0477FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0x4827bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E0477B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L04754620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E0473CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E0477B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E0477F380(_t67 + 0xc, 0x4715138, 0x10) == 0) {
								 *0x48260d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E04764F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E04764E70(0x48286b0, 0x4765690, 0, 0) != 0) {
					_t46 = E0473CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x04764d3b
0x04764d4d
0x04764d53
0x04764d58
0x04764d65
0x04764d6c
0x04764d71
0x04764d77
0x04764d7f
0x04764d8c
0x04764d8e
0x04764dad
0x04764db0
0x04764db7
0x04764db8
0x04764db9
0x04764dba
0x04764dbb
0x04764dc1
0x04764dc8
0x04764dcc
0x04764dd5
0x04764dde
0x04764ddf
0x04764de0
0x04764de1
0x04764de6
0x04764de7
0x04764de9
0x04764df3
0x00000000
0x00000000
0x047a6c7c
0x047a6c8a
0x047a6c8a
0x047a6c9d
0x047a6ca7
0x047a6cac
0x047a6cb2
0x047a6cb9
0x00000000
0x047a6cbf
0x047a6cbf
0x00000000
0x047a6cbf
0x047a6cb9
0x04764dfb
0x047a6ccf
0x047a6cd3
0x04764e32
0x04764e39
0x047a6ce0
0x047a6cf2
0x047a6cf2
0x047a6ce0
0x04764e3f
0x04764e41
0x04764e51
0x04764e51
0x04764e03
0x04764e03
0x04764e09
0x04764e0f
0x04764e57
0x00000000
0x00000000
0x04764e1b
0x04764e30
0x04764e5b
0x04764e5b
0x00000000
0x04764e30
0x04764e11
0x04764e11
0x04764e16
0x00000000
0x04764e16
0x04764e01
0x00000000
0x04764e01
0x04764da5
0x047a6c6b
0x00000000
0x04764dab
0x04764dab
0x00000000
0x04764dab

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9cc682730a553c2f43745e225d3cdae8d079decdada63184ed62a873247d93
Instruction ID: 9a75e1a8f1c3f2347373bb64b3eb4ac5f76a1269f04f3545093586cb5e43d6d7
Opcode Fuzzy Hash: ee9cc682730a553c2f43745e225d3cdae8d079decdada63184ed62a873247d93
Instruction Fuzzy Hash: 6F41E271A00318AFEB22DF24CD84FA6B7AAEB44A14F044099ED469B380D774FD44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04764BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04764BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0x482d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E0473CC50(_t86);
					L11:
					return E0477B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0x4828504
				E04752280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E0477FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E0477B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L04754620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E0473CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0x4828504
								E0474FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E04764F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x04764bad
0x04764bbf
0x04764bc2
0x04764bc6
0x04764bcd
0x04764bd9
0x047a67fe
0x047a6800
0x04764ccc
0x04764ccd
0x04764cb7
0x04764cc9
0x04764cc9
0x04764bdf
0x04764be5
0x00000000
0x00000000
0x04764beb
0x04764bef
0x00000000
0x00000000
0x04764bf5
0x04764bf9
0x04764c06
0x04764c0b
0x04764c17
0x04764c1c
0x04764c1f
0x04764c25
0x04764c33
0x04764c3d
0x04764c40
0x04764c43
0x04764c47
0x04764c4d
0x04764c53
0x04764c54
0x04764c55
0x04764c56
0x04764c5b
0x04764c5c
0x04764c63
0x04764c6b
0x00000000
0x00000000
0x047a6776
0x047a6784
0x047a6784
0x047a679f
0x047a67a7
0x047a67af
0x047a67ce
0x00000000
0x047a67b1
0x047a67b7
0x047a67b8
0x047a67c1
0x047a67d3
0x047a67d9
0x047a67dd
0x04764c94
0x04764c94
0x04764c98
0x04764c9c
0x04764ca3
0x047a67f4
0x047a67f4
0x04764cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x04764cb5
0x04764c79
0x04764c7e
0x04764c89
0x04764c8b
0x04764c8f
0x04764c8f
0x00000000
0x04764c89
0x047a67c3
0x00000000
0x047a67c3
0x047a67af
0x04764c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb8b4c3eb4863704ef64dccc7f6ae79ae1ec78760aeddead035bd6d932dc6204
Instruction ID: 5cdba22527b6a8c3587d761b38276cb82cd4efd808cd6fbad65e861a35f6f182
Opcode Fuzzy Hash: cb8b4c3eb4863704ef64dccc7f6ae79ae1ec78760aeddead035bd6d932dc6204
Instruction Fuzzy Hash: EA41C136A002289BDB20DF68C944BEA77B9EF45700F0505A5E949AB341DB74BE84CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04802B28, Relevance: .1, Instructions: 129
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E04802B28(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, intOrPtr* _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				signed int _t30;
				signed int _t35;
				unsigned int _t50;
				signed int _t52;
				signed int _t53;
				unsigned int _t58;
				signed int _t61;
				signed int _t63;
				signed int _t67;
				signed int _t69;
				intOrPtr _t75;
				signed int _t81;
				signed int _t87;
				void* _t88;
				signed int _t90;
				signed int _t93;

				_t69 = __ecx;
				_t30 = _a4;
				_t90 = __edx;
				_t81 = __ecx;
				_v12 = __ecx;
				_t87 = _t30 - 8;
				if(( *(__ecx + 0x38) & 0x00000001) != 0 && (_t30 & 0x00000fff) == 0) {
					_t87 = _t87 - 8;
				}
				_t67 = 0;
				if(_t90 != 0) {
					L14:
					if((0x0000abed ^  *(_t90 + 0x16)) ==  *((intOrPtr*)(_t90 + 0x14))) {
						_t75 = (( *_t87 ^  *0x4826110 ^ _t87) >> 0x00000001 & 0x00007fff) * 8 - 8;
						 *_a12 = _t75;
						_t35 = _a8 & 0x00000001;
						_v16 = _t35;
						if(_t35 == 0) {
							E04752280(_t35, _t81);
							_t81 = _v12;
						}
						_v5 = 0xff;
						if(( *_t87 ^  *0x4826110 ^ _t87) < 0) {
							_t91 = _v12;
							_t88 = E0480241A(_v12, _t90, _t87, _a8,  &_v5);
							if(_v16 == _t67) {
								E0474FFB0(_t67, _t88, _t91);
							}
							if(_t88 != 0) {
								E04803209(_t91, _t88, _a8);
							}
							_t67 = 1;
						} else {
							_push(_t75);
							_push(_t67);
							E047FA80D( *((intOrPtr*)(_t81 + 0x20)), 8, _a4, _t87);
							if(_v16 == _t67) {
								E0474FFB0(_t67, _t87, _v12);
							}
						}
					} else {
						_push(_t69);
						_push(_t67);
						E047FA80D( *((intOrPtr*)(_t81 + 0x20)), 0x12, _t90, _t67);
					}
					return _t67;
				}
				_t69 =  *0x4826110; // 0x4944ef1c
				_t93 = _t87;
				_t50 = _t69 ^ _t87 ^  *_t87;
				if(_t50 >= 0) {
					_t52 = _t50 >> 0x00000010 & 0x00007fff;
					if(_t52 == 0) {
						L12:
						_t53 = _t67;
						L13:
						_t90 = _t93 - (_t53 << 0x0000000c) & 0xfffff000;
						goto L14;
					}
					_t93 = _t87 - (_t52 << 3);
					_t58 =  *_t93 ^ _t69 ^ _t93;
					if(_t58 < 0) {
						L10:
						_t61 =  *(_t93 + 4) ^ _t69 ^ _t93;
						L11:
						_t53 = _t61 & 0x000000ff;
						goto L13;
					}
					_t63 = _t58 >> 0x00000010 & 0x00007fff;
					if(_t63 == 0) {
						goto L12;
					}
					_t93 = _t93 + _t63 * 0xfffffff8;
					goto L10;
				}
				_t61 =  *(_t87 + 4) ^ _t69 ^ _t87;
				goto L11;
			}

0x04802b28
0x04802b30
0x04802b35
0x04802b37
0x04802b3a
0x04802b3d
0x04802b44
0x04802b4d
0x04802b4d
0x04802b50
0x04802b54
0x04802bb0
0x04802bbd
0x04802be8
0x04802bef
0x04802bf4
0x04802bf7
0x04802bfa
0x04802bfd
0x04802c02
0x04802c02
0x04802c0f
0x04802c13
0x04802c3b
0x04802c4a
0x04802c4f
0x04802c52
0x04802c52
0x04802c59
0x04802c62
0x04802c62
0x04802c69
0x04802c15
0x04802c18
0x04802c19
0x04802c21
0x04802c29
0x04802c2f
0x04802c2f
0x04802c29
0x04802bbf
0x04802bc2
0x04802bc3
0x04802bc9
0x04802bc9
0x04802c72
0x04802c72
0x04802b56
0x04802b5c
0x04802b62
0x04802b64
0x04802b72
0x04802b77
0x04802ba3
0x04802ba3
0x04802ba5
0x04802baa
0x00000000
0x04802baa
0x04802b7e
0x04802b84
0x04802b86
0x04802b97
0x04802b9c
0x04802b9e
0x04802b9e
0x00000000
0x04802b9e
0x04802b8b
0x04802b90
0x00000000
0x00000000
0x04802b95
0x00000000
0x04802b95
0x04802b6b
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae6281ed0937d84b1bf64fe510c6535b9d454cb63cbecfd1aac8cb22c10f1c10
Instruction ID: 55305d6d1b4ad12b39afc85e840ba20f4b94b9ab949962537d474d7232f96302
Opcode Fuzzy Hash: ae6281ed0937d84b1bf64fe510c6535b9d454cb63cbecfd1aac8cb22c10f1c10
Instruction Fuzzy Hash: 1341D872A205159BD754DF28CC9897AB7A9EF48314B05CBE9E815D73C0E6B4FD018790

Uniqueness

Uniqueness Score: -1.00%

Function 04748A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E04748A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0x482d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E0477B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E0474E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0x4711180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E04761DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E04773C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E04748999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x04748a0a
0x04748a1c
0x04748a23
0x04748a2e
0x04748a30
0x04748a36
0x04748a3c
0x04748a3e
0x04748a4a
0x04748a52
0x04748a9c
0x04748aae
0x04748a58
0x04748a5e
0x04748a6a
0x04748a6f
0x04748a75
0x04748a7d
0x04748a85
0x04748a86
0x04748a89
0x04748a93
0x04748a99
0x04748a9b
0x00000000
0x04748aaf
0x04748abe
0x04748ac3
0x04748acb
0x04748ad7
0x04748ae0
0x04748af1
0x00000000
0x04748af1
0x04748acd
0x04748ad5
0x04748afb
0x04748afd
0x04748aff
0x04748b07
0x04748b22
0x04748b24
0x04748b2a
0x04748b2e
0x04748b3f
0x04748b78
0x04748b41
0x04748b52
0x04748b54
0x04748b5c
0x04748b74
0x04748b74
0x04748b5c
0x04748b3f
0x04748b5e
0x04748b61
0x04748b64
0x04748b64
0x04748b6c
0x04748b6c
0x04748b11
0x04799cd5
0x04799cd5
0x04748b17
0x04748b1a
0x04748b1a
0x00000000
0x04748ad5
0x04748a89

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98a982b2a0e614ddbad3836848c1e44a360b57eff16446815690522b164c5647
Instruction ID: ed8746c63e6ec3173ec0e9877f1d34f4b524c295d0bc95e103732d0bcc4acb0b
Opcode Fuzzy Hash: 98a982b2a0e614ddbad3836848c1e44a360b57eff16446815690522b164c5647
Instruction Fuzzy Hash: 57414FB4A0022C9BDB34EF59CC88AB9B7F5EB84304F1145E9D91997351E770AE84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 047FFDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E047FFDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E047FFD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E04800A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E04757D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E047F1608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E04802B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E047FC8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E047FDBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E04757D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E047FA80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x047ffde7
0x047ffde8
0x047ffdec
0x047ffdee
0x047ffdf5
0x047ffdf7
0x047ffdfc
0x047ffe19
0x047ffe22
0x047ffe26
0x047ffec6
0x047ffecd
0x047ffed5
0x047ffee7
0x047ffed7
0x047ffee0
0x047ffee0
0x047ffeef
0x047fff00
0x047fff02
0x047fff07
0x047fff07
0x00000000
0x047ffeef
0x047ffe33
0x047ffe55
0x047ffe59
0x047ffe5b
0x047ffe5e
0x047ffe69
0x047ffe6d
0x047ffe6d
0x047ffe69
0x047ffe35
0x047ffe41
0x047ffe41
0x047ffe79
0x047ffe8b
0x047ffe7b
0x047ffe84
0x047ffe84
0x047ffe93
0x00000000
0x047ffea8
0x047ffeba
0x00000000
0x047ffeba
0x047ffdfe
0x047ffe01
0x047ffe02
0x047ffe08
0x047fff0c
0x047fff14
0x047fff14

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 0369fc569816d53fed05296d10073cf2ed0e0c415677f6a76d451835f3ddcb72
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: 7931F632304640AFD7269B79CC48F6A7BE9EF85750F18455AEA468B351DEB4FC41C710

Uniqueness

Uniqueness Score: -1.00%

Function 048022AE, Relevance: .1, Instructions: 116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E048022AE(void* __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, char* _a12) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t50;
				signed int _t53;
				void* _t63;
				signed char _t71;
				signed char _t75;
				signed int _t77;
				unsigned int _t106;
				void* _t114;
				signed int _t117;

				_v20 = _v20 & 0x00000000;
				_t117 = _a4;
				_t114 = __ecx;
				_v24 = __edx;
				E048021E8(_t117, __edx,  &_v16,  &_v12);
				if(_v24 != 0 && (_v12 | _v8) != 0) {
					_t71 =  !_v8;
					_v16 =  !_v12 >> 8 >> 8;
					_t72 = _t71 >> 8;
					_t50 = _v16;
					_t20 = (_t50 >> 8) + 0x471ac00; // 0x6070708
					_t75 = ( *((intOrPtr*)((_t71 >> 8 >> 8 >> 8) + 0x471ac00)) +  *((intOrPtr*)((_t71 >> 0x00000008 >> 0x00000008 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x471ac00)) & 0x000000ff) + ( *_t20 +  *((intOrPtr*)((_t50 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x471ac00)) & 0x000000ff);
					_v16 = _t75;
					if(( *(__ecx + 0x38) & 0x00000002) != 0) {
						L6:
						_t53 =  *0x4826110; // 0x4944ef1c
						 *_t117 = ( !_t53 ^  *_t117 ^ _t117) & 0x7fffffff ^  !_t53 ^ _t117;
						 *(_t117 + 4) = (_t117 - _v24 >> 0x0000000c ^  *0x4826110 ^ _t117) & 0x000000ff | 0x00000200;
						_t77 = _a8 & 0x00000001;
						if(_t77 == 0) {
							E0474FFB0(_t77, _t114, _t114);
						}
						_t63 = E04802FBD(_t114, _v24, _v12, _v8, _v16, 0);
						_v36 = 1;
						if(_t77 == 0) {
							E04752280(_t63, _t114);
						}
						 *(_t117 + 4) =  *(_t117 + 4) & 0xfffffdff;
						 *_a12 = 0xff;
					} else {
						_t106 =  *(__ecx + 0x18) >> 7;
						if(_t106 <= 8) {
							_t106 = 8;
						}
						if( *((intOrPtr*)(_t114 + 0x1c)) + _t75 > _t106) {
							goto L6;
						}
					}
				}
				return _v20;
			}

0x048022b9
0x048022c2
0x048022c6
0x048022c8
0x048022d8
0x048022e2
0x04802303
0x04802314
0x04802321
0x0480234a
0x0480235b
0x0480236c
0x04802372
0x04802376
0x0480238f
0x0480238f
0x048023b4
0x048023c6
0x048023c9
0x048023cc
0x048023cf
0x048023cf
0x048023e9
0x048023ee
0x048023f8
0x048023fb
0x048023fb
0x04802403
0x0480240a
0x04802378
0x0480237b
0x04802381
0x04802385
0x04802385
0x0480238d
0x00000000
0x00000000
0x0480238d
0x04802376
0x04802417

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3475b3c623ce0bcc9301374dac1b391d954b6b60e246578261d816ec67fe986c
Instruction ID: b8fa50983dd8f4d9b7af3e3af4f960eecbb9c2863d00ad8526861314eb698731
Opcode Fuzzy Hash: 3475b3c623ce0bcc9301374dac1b391d954b6b60e246578261d816ec67fe986c
Instruction Fuzzy Hash: E641E4711143418BD308CF29C8A597ABBE0EFC5325F058A9DF4D58B2D2CA78E809C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 048020A8, Relevance: .1, Instructions: 114
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E048020A8(intOrPtr __ecx, intOrPtr __edx, signed int _a4, signed int* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _t35;
				signed int _t57;
				unsigned int _t61;
				signed int _t63;
				signed int _t64;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				signed int _t83;
				signed int _t84;
				unsigned int _t92;
				unsigned int _t97;
				signed int _t100;
				unsigned int _t102;

				_t79 = __edx;
				_t35 =  *0x4826110; // 0x4944ef1c
				_t57 = _a4;
				_v8 = __ecx;
				_t84 =  *_t57;
				_v12 = __edx;
				_t61 = _t84 ^ _t35 ^ _t57;
				_t83 = _t61 >> 0x00000001 & 0x00007fff;
				_v20 = _t83;
				 *_t57 = (_t84 ^ _t35 ^ _t57) & 0x7fffffff ^ _t35 ^ _t57;
				_t63 = _t61 >> 0x00000010 & 0x00007fff;
				if(_t63 != 0) {
					_t100 =  *0x4826110; // 0x4944ef1c
					_t77 = _t57 - (_t63 << 3);
					_v16 = _t77;
					_t102 = _t100 ^ _t77 ^  *_t77;
					_t106 = _t102;
					if(_t102 >= 0) {
						E04802E3F(_v8, __edx, _t106, _t77);
						_t57 = _v16;
						_t79 = _v12;
						_t83 = _t83 + (_t102 >> 0x00000001 & 0x00007fff);
					}
				}
				_t64 = _t57 + _t83 * 8;
				if(_t64 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
					asm("lfence");
					_t97 =  *_t64 ^  *0x4826110 ^ _t64;
					_t109 = _t97;
					if(_t97 >= 0) {
						E04802E3F(_v8, _t79, _t109, _t64);
						_t79 = _v12;
						_t83 = _t83 + (_t97 >> 0x00000001 & 0x00007fff);
					}
				}
				if(( *(_v8 + 0x38) & 0x00000001) != 0) {
					_t73 = _t57 + _t83 * 8;
					if(_t73 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
						asm("lfence");
						_t92 =  *_t73 ^  *0x4826110 ^ _t73;
						_t113 = _t92;
						if(_t92 >= 0) {
							E04802E3F(_v8, _t79, _t113, _t73);
							_t83 = _t83 + (_t92 >> 0x00000001 & 0x00007fff);
						}
					}
				}
				if(_v20 != _t83) {
					_t66 = _v12;
					_t80 = _t57 + _t83 * 8;
					 *_t57 =  *_t57 ^ (_t83 + _t83 ^  *_t57 ^  *0x4826110 ^ _t57) & 0x0000fffe;
					if(_t80 < _v12 + (( *(_t66 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t80 =  *_t80 ^ (_t83 << 0x00000010 ^  *_t80 ^  *0x4826110 ^ _t80) & 0x7fff0000;
					}
				}
				 *_a8 = _t83;
				return _t57;
			}

0x048020a8
0x048020b0
0x048020b6
0x048020ba
0x048020be
0x048020c4
0x048020cb
0x048020db
0x048020e4
0x048020e7
0x048020e9
0x048020ef
0x048020f1
0x048020fe
0x04802102
0x04802105
0x04802105
0x04802107
0x0480210d
0x04802112
0x04802115
0x04802120
0x04802120
0x04802107
0x04802126
0x04802131
0x04802133
0x0480213e
0x0480213e
0x04802140
0x04802146
0x0480214b
0x04802156
0x04802156
0x04802140
0x0480215f
0x04802165
0x04802170
0x04802172
0x0480217d
0x0480217d
0x0480217f
0x04802185
0x04802192
0x04802192
0x0480217f
0x04802170
0x04802197
0x04802199
0x048021a1
0x048021b1
0x048021bf
0x048021d6
0x048021d6
0x048021bf
0x048021dd
0x048021e5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f565c6d1c28150ce244e32479ded07925f0533516ae62400e0493bb24b0d743
Instruction ID: 2cf0b8bd19376f38660f7f10fe5bdc76b216be901be2752607cfc1e98c4db189
Opcode Fuzzy Hash: 2f565c6d1c28150ce244e32479ded07925f0533516ae62400e0493bb24b0d743
Instruction Fuzzy Hash: EE416E33E1002A8BCB18CFA8C895579B3B1FB483057568AF9D815FB291EB74BD51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04802D07, Relevance: .1, Instructions: 112
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E04802D07(void* __ecx, void* __edx, void* __eflags, signed short _a4) {
				char _v5;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int* _v24;
				signed int _t34;
				signed char _t40;
				signed int* _t49;
				signed int _t55;
				signed char _t57;
				signed char _t58;
				signed char _t59;
				signed short _t60;
				unsigned int _t66;
				unsigned int _t71;
				signed int _t77;
				signed char _t83;
				signed char _t84;
				signed int _t91;
				signed int _t93;
				signed int _t96;

				_t34 = E048021E8(_a4, __edx,  &_v24,  &_v20);
				_t83 =  !_v20;
				_t57 =  !_v16;
				_t84 = _t83 >> 8;
				_v12 = _t84 >> 8;
				_v5 =  *((intOrPtr*)((_t83 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t84 & 0x000000ff) + 0x471ac00));
				_t58 = _t57 >> 8;
				_t59 = _t58 >> 8;
				_t66 = _t59 >> 8;
				_t60 = _a4;
				_t13 = _t66 + 0x471ac00; // 0x6070708
				_t40 = _v12;
				_t71 = _t40 >> 8;
				_v12 = 0;
				_t17 = _t71 + 0x471ac00; // 0x6070708
				 *((intOrPtr*)(__ecx + 0x1c)) =  *((intOrPtr*)(__ecx + 0x1c)) + ( *_t13 +  *((intOrPtr*)((_t59 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t57 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t58 & 0x000000ff) + 0x471ac00)) & 0x000000ff) + ( *_t17 +  *((intOrPtr*)((_t40 & 0x000000ff) + 0x471ac00)) + _v5 & 0x000000ff);
				 *_t60 =  *_t60 ^ ( *_t60 ^  *0x4826110 ^ _t34 ^ _t60) & 0x00000001;
				_t49 = __ecx + 8;
				_t77 =  *_t60 & 0x0000ffff ^ _t60 & 0x0000ffff ^  *0x4826110 & 0x0000ffff;
				_t91 =  *_t49;
				_t96 = _t49[1] & 1;
				_v24 = _t49;
				if(_t91 != 0) {
					_t93 = _t77;
					L2:
					while(1) {
						if(_t93 < (_t91 - 0x00000004 & 0x0000ffff ^  *(_t91 - 4) & 0x0000ffff ^  *0x4826110 & 0x0000ffff)) {
							_t55 =  *_t91;
							if(_t96 == 0) {
								L11:
								if(_t55 == 0) {
									goto L13;
								} else {
									goto L12;
								}
							} else {
								if(_t55 == 0) {
									L13:
									_v12 = 0;
								} else {
									_t55 = _t55 ^ _t91;
									goto L11;
								}
							}
						} else {
							_t55 =  *(_t91 + 4);
							if(_t96 == 0) {
								L6:
								if(_t55 != 0) {
									L12:
									_t91 = _t55;
									continue;
								} else {
									goto L7;
								}
							} else {
								if(_t55 == 0) {
									L7:
									_v12 = 1;
								} else {
									_t55 = _t55 ^ _t91;
									goto L6;
								}
							}
						}
						goto L14;
					}
				}
				L14:
				_t29 = _t60 + 4; // 0x4
				return E0474B090(_v24, _t91, _v12, _t29);
			}

0x04802d1f
0x04802d2c
0x04802d31
0x04802d33
0x04802d42
0x04802d4b
0x04802d51
0x04802d5d
0x04802d62
0x04802d6e
0x04802d71
0x04802d7d
0x04802d87
0x04802d8d
0x04802d91
0x04802da5
0x04802db7
0x04802dc8
0x04802dcf
0x04802dd1
0x04802dd3
0x04802dd6
0x04802ddb
0x04802ddd
0x00000000
0x04802ddf
0x04802df5
0x04802e0e
0x04802e12
0x04802e1a
0x04802e1c
0x00000000
0x00000000
0x00000000
0x00000000
0x04802e14
0x04802e16
0x04802e22
0x04802e22
0x04802e18
0x04802e18
0x00000000
0x04802e18
0x04802e16
0x04802df7
0x04802df7
0x04802dfc
0x04802e04
0x04802e06
0x04802e1e
0x04802e1e
0x00000000
0x00000000
0x00000000
0x00000000
0x04802dfe
0x04802e00
0x04802e08
0x04802e08
0x04802e02
0x04802e02
0x00000000
0x04802e02
0x04802e00
0x04802dfc
0x00000000
0x04802df5
0x04802ddf
0x04802e26
0x04802e26
0x04802e3c

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0ab10c923cba3d0898ac810a11271fc13c701674e1b1e7499408bd4c694383a
Instruction ID: 688112ce85d0973a340236c5f591e71ca2cd8fe4e79ac8952103b17b479e8de5
Opcode Fuzzy Hash: d0ab10c923cba3d0898ac810a11271fc13c701674e1b1e7499408bd4c694383a
Instruction Fuzzy Hash: 84415C359001955FC744CF69C894ABA7FF4EF85311B09C5E6DC81EB282DA38ED4AC3A0

Uniqueness

Uniqueness Score: -1.00%

Function 047FEA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E047FEA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E04752280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E047FE815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E0473F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E0474FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E047FAFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					E047FBCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E04757D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E047EFE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E0474FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E047FA80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x047fea55
0x047fea66
0x047fea68
0x047fea6c
0x047fea6f
0x047fea72
0x047fea75
0x047fea7a
0x047fea7a
0x047fea7e
0x047fea80
0x047fea85
0x047fea8b
0x047feab5
0x047feabc
0x047feabf
0x047feabf
0x047feaca
0x047feace
0x047fead0
0x047feae4
0x047feaeb
0x047feaf0
0x047feaf5
0x047feb09
0x047feb0d
0x047feb1d
0x047feb2d
0x047feb38
0x047feb3d
0x047feb41
0x047feb4a
0x047feb60
0x047feb4c
0x047feb52
0x047feb59
0x047feb59
0x047feb68
0x047feb71
0x047feb71
0x047fea8d
0x047fea8f
0x047fea92
0x047fea97
0x047fea97
0x047fea9b
0x047fea9c
0x047fea9e
0x047feaa6
0x047feaa6
0x047feb7e

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 3a2e8498fd1ac06d632a1d945ca1784bd94cef7ae846c537a2d6e18d678c1115
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 9831C132614705ABD729DF28CC84A6BB7AAFBC4314F04492DEA5687750EF30F805CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 047B69A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E047B69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0x482d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L04746C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E047B6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E04779980() >= 0) {
							E04752280(_t56, 0x4828778);
							_t77 = 1;
							_t68 = 1;
							if( *0x4828774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0x4828774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E0473B6F0(0x471c338, 0x471c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E04779520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E047795D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E0474FFB0(_t68, _t77, 0x4828778);
				}
				_pop(_t78);
				return E0477B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x047b69b5
0x047b69be
0x047b69c3
0x047b69c9
0x047b69cc
0x047b69d1
0x047b69d3
0x047b69de
0x047b69e1
0x047b69ea
0x047b69f6
0x047b69fe
0x047b6a13
0x047b6a14
0x047b6a15
0x047b6a16
0x047b6a1e
0x047b6a26
0x047b6a31
0x047b6a36
0x047b6a37
0x047b6a40
0x047b6a49
0x047b6a4a
0x047b6a53
0x047b6a59
0x047b6a5d
0x047b6a5e
0x047b6a64
0x047b6a67
0x047b6a6a
0x047b6a6d
0x047b6a70
0x047b6a77
0x047b6a7d
0x047b6a86
0x047b6a89
0x047b6a9c
0x047b6a9f
0x047b6aa2
0x047b6aa5
0x047b6aaf
0x047b6ab1
0x047b6ab8
0x047b6ab9
0x047b6abb
0x047b6abe
0x047b6ac5
0x047b6ac5
0x047b6aaf
0x047b6a40
0x047b6a26
0x047b69fe
0x047b6ace
0x047b6ad0
0x047b6ad3
0x047b6ad8
0x047b6adf
0x047b6adf
0x047b6ae8
0x047b6aef
0x047b6aef
0x047b6af9
0x047b6b06

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c2ca46f3a19c585d133838694af0b293c20c39ac1d737663cd14bde5ef71a1d
Instruction ID: c4eae37b18e43e032d046e44024937780f30e4bdd7a0075ba1aa07a206ab08e0
Opcode Fuzzy Hash: 8c2ca46f3a19c585d133838694af0b293c20c39ac1d737663cd14bde5ef71a1d
Instruction Fuzzy Hash: 49418DB1D01208AFEB20DFA5D940BFEBBF4EF48714F14852AE954A7350DB74A905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04735210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04735210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E047352A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E047795D0();
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E0474EB70(_t54, 0x48279a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E047795D0();
								L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E0474EB70(_t54, 0x48279a0);
						}
						return _t52;
					}
					L5:
					_t33 = E0477F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E0474EB70(_t54, 0x48279a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E047795D0();
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x04735220
0x04735224
0x04790d13
0x04790d16
0x04790d19
0x0473522a
0x0473522a
0x0473522d
0x0473522d
0x04735231
0x04735235
0x04735239
0x04790d5c
0x04790d62
0x00000000
0x00000000
0x04790d6a
0x04790d7b
0x04790d7f
0x04790d81
0x04790d84
0x04790d95
0x04790d95
0x04790d6c
0x04790d71
0x04790d71
0x04790d9a
0x00000000
0x0473524a
0x0473524a
0x04735250
0x04790d24
0x04790d35
0x04790d39
0x04790d3b
0x04790d3e
0x04790d50
0x04790d50
0x04790d26
0x04790d2b
0x04790d2b
0x00000000
0x04790d55
0x04735256
0x0473525b
0x04735265
0x04790da7
0x0473526b
0x0473526e
0x04735272
0x04790db1
0x04790db4
0x04790dc5
0x04790dc5
0x04735272
0x04735278
0x0473527e
0x0473528a
0x0473528c
0x0473528d
0x00000000
0x04735280
0x04735282
0x04735288
0x0473529f
0x04735292
0x00000000
0x04735292
0x00000000
0x04735288
0x0473527e

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d8d913cb6d2430bad075cf156d0a88cfd4dc35989aecfcee9ca0124b1da5b9d
Instruction ID: 8b2ff921f7d8615ee633b4b72cddd79c80b340bf0abd82172623edb92cf7e64a
Opcode Fuzzy Hash: 2d8d913cb6d2430bad075cf156d0a88cfd4dc35989aecfcee9ca0124b1da5b9d
Instruction Fuzzy Hash: 0F315571261A50EBDB229F28DA84F3677B5FF00725F154A29E8154B7A1EB70FC00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04773D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04773D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E04747B60(0, _t61, 0x47111c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E04747B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						 *((short*)(_t61[2] + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L04754620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x04773d4c
0x04773d50
0x04773d55
0x04773d5e
0x047ae79a
0x00000000
0x047ae79a
0x04773d68
0x047ae789
0x04773d9d
0x04773da3
0x04773daf
0x04773db5
0x04773dbc
0x04773dc4
0x04773dc9
0x04773dce
0x047ae7ae
0x047ae7ae
0x04773dde
0x04773de2
0x04773de7
0x04773e0d
0x04773e13
0x04773e16
0x04773e1e
0x04773e25
0x04773e28
0x00000000
0x00000000
0x04773e2a
0x04773e2f
0x04773e37
0x04773e37
0x00000000
0x04773e37
0x04773e31
0x00000000
0x04773e31
0x04773e20
0x04773e20
0x04773e35
0x00000000
0x04773de9
0x04773de9
0x04773de9
0x04773dee
0x04773dfd
0x04773dff
0x04773e02
0x04773e05
0x04773e05
0x00000000
0x04773df0
0x04773de7
0x047ae78f
0x047ae794
0x04773d79
0x04773d84
0x04773d89
0x04773d8e
0x00000000
0x047ae7a4
0x04773d96
0x04773d9a
0x00000000
0x04773d9a
0x00000000
0x047ae794
0x04773d6e
0x04773d73
0x00000000
0x047ae7b5
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a990cbde4120a57a568243592b48ff5fde30f540e2536f3660a83e2de3320e74
Instruction ID: da915d41c1dc972197034901cd0cf2fdf097666f39207ef409588a246f9a0bea
Opcode Fuzzy Hash: a990cbde4120a57a568243592b48ff5fde30f540e2536f3660a83e2de3320e74
Instruction Fuzzy Hash: E431BC71B04615DBCB288F2AC841A7ABBE5EF95700B45C46AE84ACB360F770E840E791

Uniqueness

Uniqueness Score: -1.00%

Function 0476A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0476A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0x4810220);
				E0478D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0x4827b9c; // 0x0
				_t55 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E0478D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0x4827b10 =  *0x4827b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0x482536c; // 0x80b0d0
					if( *_t51 != 0x4825368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0x4825368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0x482536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E0476A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x0476a61c
0x0476a61e
0x0476a623
0x0476a628
0x0476a62b
0x0476a62d
0x0476a648
0x0476a64a
0x0476a64f
0x047a9b44
0x0476a6ec
0x0476a6f1
0x0476a6f1
0x0476a655
0x0476a657
0x0476a65a
0x0476a65d
0x0476a662
0x0476a663
0x0476a667
0x0476a668
0x0476a66d
0x0476a706
0x0476a706
0x047a9bda
0x047a9be6
0x047a9beb
0x00000000
0x047a9beb
0x0476a679
0x047a9b7a
0x00000000
0x047a9b7a
0x0476a683
0x0476a6f4
0x0476a6f7
0x0476a6f9
0x0476a6fd
0x0476a6a0
0x0476a6a0
0x0476a6ad
0x0476a6af
0x0476a6b4
0x047a9ba7
0x047a9bac
0x00000000
0x00000000
0x047a9bc6
0x047a9bce
0x047a9bd1
0x047a9bd3
0x047a9bd3
0x00000000
0x047a9bd1
0x0476a6bd
0x0476a6c3
0x0476a6c6
0x0476a6d2
0x0476a701
0x0476a704
0x00000000
0x0476a704
0x0476a6d4
0x0476a6d6
0x0476a6d9
0x0476a6db
0x0476a6e1
0x0476a6e6
0x0476a6e8
0x0476a6e8
0x0476a6ea
0x00000000
0x0476a6ea
0x0476a688
0x0476a692
0x0476a694
0x0476a699
0x00000000
0x00000000
0x0476a69d
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ffa50397972b86dc452132d71037c4d44a8f6d1c0ba5c98500cb074fb154fc8
Instruction ID: 79d00e89119e805f5f59a4fbf292778fa923fc9fca2596ea7b4e7c3627434256
Opcode Fuzzy Hash: 8ffa50397972b86dc452132d71037c4d44a8f6d1c0ba5c98500cb074fb154fc8
Instruction Fuzzy Hash: 344186B5A00205DFCB14CF59C980B99BBF2FB8A304F1885A9E905AB340D379B941CF90

Uniqueness

Uniqueness Score: -1.00%

Function 047B7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E047B7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0x482d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E047B6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E047B6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E04757D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E04779AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E0477B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L04754620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x047b7016
0x047b701e
0x047b702b
0x047b7033
0x047b7037
0x047b703c
0x047b703e
0x047b7041
0x047b7045
0x047b704a
0x047b7050
0x047b7055
0x047b705a
0x047b7062
0x047b7062
0x047b705a
0x047b7064
0x047b7064
0x047b7067
0x047b7071
0x047b7096
0x047b709b
0x047b70a2
0x047b70a6
0x047b70a7
0x047b70ad
0x047b70b3
0x047b70b6
0x047b70bb
0x047b70c3
0x047b70c3
0x047b70c6
0x047b70cd
0x047b70dd
0x047b70e0
0x047b70e2
0x047b70e2
0x047b70ee
0x047b7101
0x047b70f0
0x047b70f9
0x047b70f9
0x047b710a
0x047b710e
0x047b7112
0x047b7117
0x047b7118
0x047b7118
0x047b70bb
0x047b711d
0x047b7123
0x047b7131
0x047b7131
0x047b7136
0x047b713d
0x047b713e
0x047b713f
0x047b714a
0x047b714a
0x047b7084
0x047b7088
0x00000000
0x047b708e
0x047b708e
0x047b7092
0x00000000
0x047b7092

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e535c4964ab7889946bf8936a97fcb2805953000d882dddc1e7b2aa6c9d3a65
Instruction ID: e88a6949a85dc2a141413897f5931d0dc88905cc8aac8889826ecc4b0064daa0
Opcode Fuzzy Hash: 4e535c4964ab7889946bf8936a97fcb2805953000d882dddc1e7b2aa6c9d3a65
Instruction Fuzzy Hash: FA31AF726047559BC324DF68C944BAAB7A9FFC8700F044A29F9958B790E730F904CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0475C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0475C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E04757D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E04808D34(_v8, _t80);
					}
					E04752280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E0474FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E04808833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E0474FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E0477B180();
						if(_a4 != 0) {
							E04752280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E0475BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E0475BB2D(_t16, _t15);
						E0475B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E0474FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E0474FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E0474FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x0475c18d
0x0475c18f
0x0475c191
0x0475c19b
0x0475c1a0
0x0475c1d4
0x0475c1de
0x047a2d6e
0x0475c1e4
0x0475c1e4
0x0475c1e4
0x0475c1ec
0x047a2d7d
0x047a2d7d
0x0475c1f3
0x0475c1ff
0x047a2d88
0x047a2d8d
0x047a2d94
0x047a2d94
0x047a2d9f
0x047a2da4
0x047a2dab
0x047a2db0
0x047a2db2
0x047a2db3
0x047a2db4
0x047a2dbc
0x047a2dc3
0x047a2dc3
0x0475c205
0x0475c205
0x0475c208
0x0475c20e
0x0475c211
0x0475c216
0x0475c219
0x0475c21f
0x0475c222
0x0475c22c
0x0475c234
0x0475c23a
0x0475c23f
0x0475c245
0x0475c24b
0x0475c251
0x0475c25a
0x0475c276
0x0475c27d
0x0475c27d
0x0475c25c
0x0475c25c
0x00000000
0x0475c25e
0x0475c1a4
0x0475c1aa
0x0475c1b3
0x0475c265
0x0475c26c
0x0475c26c
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 551a4f5a2724cec2bd521dae87df9a4a7c0ad8ce01d320b1a7451ac0d6f36c3c
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 08312671B01686AFE705EBB4C884BF9F754BF42208F04815AC91C8F351DBB47A55DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04776DE6, Relevance: .1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04776DE6(signed int __ecx, void* __edx, signed int _a4, intOrPtr* _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t39;
				intOrPtr _t52;
				intOrPtr _t53;
				signed int _t59;
				signed int _t63;
				intOrPtr _t64;
				intOrPtr* _t66;
				void* _t68;
				intOrPtr _t69;
				signed int _t73;
				signed int _t75;
				intOrPtr _t77;
				signed int _t80;
				intOrPtr _t82;

				_t68 = __edx;
				_push(__ecx);
				_t80 = __ecx;
				_t75 = _a4;
				if(__edx >  *((intOrPtr*)(__ecx + 0x90))) {
					L23:
					asm("lock inc dword [esi+0x110]");
					if(( *(_t80 + 0xd4) & 0x00010000) != 0) {
						asm("lock inc dword [ecx+eax+0x4]");
					}
					_t39 = 0;
					L13:
					return _t39;
				}
				_t63 =  *(__ecx + 0x88);
				_t4 = _t68 + 7; // 0xa
				_t69 =  *((intOrPtr*)(__ecx + 0x8c));
				_t59 = _t4 & 0xfffffff8;
				_v8 = _t69;
				if(_t75 >= _t63) {
					_t75 = _t75 % _t63;
					L15:
					_t69 = _v8;
				}
				_t64 =  *((intOrPtr*)(_t80 + 0x17c + _t75 * 4));
				if(_t64 == 0) {
					L14:
					if(E04776EBE(_t80, _t64, _t75) != 1) {
						goto L23;
					}
					goto L15;
				}
				asm("lock inc dword [ecx+0xc]");
				if( *((intOrPtr*)(_t64 + 0x2c)) != 1 ||  *((intOrPtr*)(_t64 + 8)) > _t69) {
					goto L14;
				} else {
					_t73 = _t59;
					asm("lock xadd [eax], edx");
					if(_t73 + _t59 > _v8) {
						if(_t73 <= _v8) {
							 *(_t64 + 4) = _t73;
						}
						goto L14;
					}
					_t77 = _t73 + _t64;
					_v8 = _t77;
					 *_a12 = _t64;
					_t66 = _a8;
					if(_t66 == 0) {
						L12:
						_t39 = _t77;
						goto L13;
					}
					_t52 =  *((intOrPtr*)(_t80 + 0x10));
					if(_t52 != 0) {
						_t53 = _t52 - 1;
						if(_t53 == 0) {
							asm("rdtsc");
							 *_t66 = _t53;
							L11:
							 *(_t66 + 4) = _t73;
							goto L12;
						}
						E04766A60(_t66);
						goto L12;
					}
					while(1) {
						_t73 =  *0x7ffe0018;
						_t82 =  *0x7FFE0014;
						if(_t73 ==  *0x7FFE001C) {
							break;
						}
						asm("pause");
					}
					_t66 = _a8;
					_t77 = _v8;
					 *_t66 = _t82;
					goto L11;
				}
			}

0x04776de6
0x04776dee
0x04776df1
0x04776df4
0x04776dfd
0x047b05d3
0x047b05d3
0x047b05e4
0x047b05f9
0x047b05f9
0x047b05fe
0x04776e96
0x04776e9c
0x04776e9c
0x04776e03
0x04776e09
0x04776e0c
0x04776e12
0x04776e15
0x04776e1b
0x047b05a1
0x04776eb1
0x04776eb1
0x04776eb1
0x04776e21
0x04776e2a
0x04776e9f
0x04776eab
0x00000000
0x00000000
0x00000000
0x04776eab
0x04776e2c
0x04776e34
0x00000000
0x04776e3d
0x04776e3d
0x04776e42
0x04776e4d
0x047b05ac
0x047b05b2
0x047b05b2
0x00000000
0x047b05ac
0x04776e56
0x04776e59
0x04776e5d
0x04776e5f
0x04776e64
0x04776e94
0x04776e94
0x00000000
0x04776e94
0x04776e6a
0x04776e6d
0x047b05ba
0x047b05bd
0x047b05ca
0x047b05cc
0x04776e91
0x04776e91
0x00000000
0x04776e91
0x047b05c0
0x00000000
0x047b05c0
0x04776e7e
0x04776e7e
0x04776e80
0x04776e86
0x00000000
0x00000000
0x04776eba
0x04776eba
0x04776e88
0x04776e8b
0x04776e8f
0x00000000
0x04776e8f

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f5923ccfc62e11761a64181f477a9fcd764954153fe337c5a9bd4bea8846838
Instruction ID: 15041c824bbc3560e96e531be154ee043d07e60315a629a81aac57c616bebbc5
Opcode Fuzzy Hash: 8f5923ccfc62e11761a64181f477a9fcd764954153fe337c5a9bd4bea8846838
Instruction Fuzzy Hash: 0431A431304605DFCB24CF29C480AABB3A6FF85324B54C95DE45A9B355EB71F802CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0476A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0476A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0x4827b10; // 0x9
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0x4827b10 = 8;
					 *0x4827b14 = 0x4827b0c;
					 *0x4827b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0xa
					E0476A990(0x4827b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L0476A840(__edx, __ecx, __ecx, _t52, 0x4827b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0x4827b10; // 0x9
					_t3 = _t37 + 0x27; // 0x30
					__eflags = _t3 >> 5 -  *0x4827b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0x4827b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x30
						_v8 = _t4 >> 5;
						_t50 = L04754620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0x4827b18 = _v8;
						_t8 = _t52 + 7; // 0x10
						E0477F3E0(_t50,  *0x4827b14, _t8 >> 3);
						_t28 =  *0x4827b14; // 0x776f7b0c
						__eflags = _t28 - 0x4827b0c;
						if(_t28 != 0x4827b0c) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x11
						 *0x4827b14 = _t50;
						_t48 = _v12;
						 *0x4827b10 = _t9;
						goto L6;
					}
					 *0x4827b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x0476a713
0x0476a714
0x0476a717
0x0476a71d
0x0476a720
0x0476a722
0x0476a727
0x0476a74a
0x0476a754
0x0476a75e
0x0476a768
0x0476a76a
0x0476a773
0x0476a78b
0x0476a790
0x0476a792
0x0476a741
0x0476a741
0x0476a743
0x0476a749
0x0476a749
0x0476a732
0x0476a73a
0x0476a797
0x0476a79d
0x0476a7a3
0x0476a7a9
0x0476a7b6
0x0476a7bc
0x0476a7ca
0x0476a7e0
0x0476a7e2
0x0476a7e4
0x047a9bf2
0x00000000
0x047a9bf2
0x0476a7ed
0x0476a7f2
0x0476a800
0x0476a805
0x0476a80d
0x0476a812
0x047a9c08
0x047a9c08
0x0476a818
0x0476a81b
0x0476a821
0x0476a824
0x00000000
0x0476a824
0x0476a7ae
0x00000000
0x0476a7ae
0x0476a73c
0x0476a73e
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96859237120d95b5e7c2f0000600a81b92d20ff4c5eed524704e0e5a43981c9a
Instruction ID: d41855fa83e5d8745f5046dc79930d258b80a170e91a2b911679eb28deb549cb
Opcode Fuzzy Hash: 96859237120d95b5e7c2f0000600a81b92d20ff4c5eed524704e0e5a43981c9a
Instruction Fuzzy Hash: 6631AEB16002019BD721CF1ADA80F2577FAEB86710F148E5AE506E7340E77AAD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 047661A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E047661A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E04765E50(0x47167cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E04809D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E0473F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x047661b3
0x047661b5
0x047661bd
0x047661c3
0x047661c7
0x047661d2
0x047661ff
0x047661ff
0x04766201
0x04766207
0x04766207
0x047661d4
0x047661d9
0x00000000
0x00000000
0x047661df
0x047661e2
0x00000000
0x00000000
0x047661e6
0x047661e8
0x047661ee
0x047661ee
0x047661f9
0x047a762f
0x047a7632
0x047a7635
0x047a7639
0x047a7640
0x047a766e
0x047a7675
0x00000000
0x00000000
0x047a7681
0x047a7689
0x047a768d
0x047a7691
0x047a7695
0x047a7699
0x047a76af
0x047a76b5
0x047a76b7
0x047a76b7
0x047a76d7
0x047a76dc
0x00000000
0x047a76dc
0x047a76a2
0x047a76a9
0x047a7651
0x047a7653
0x047a7653
0x047a7656
0x047a7656
0x00000000
0x047a7656
0x047a7644
0x047a7646
0x047a7648
0x047a7648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f480649a9f4c7a897aaafdd099ff4b305e651944eae4e8a76b167c093da5c1ef
Instruction ID: 9bcfc4d69fe23f39cefae4ebf20a0bd6179f0e6c87c775be05ad38b2aabe805f
Opcode Fuzzy Hash: f480649a9f4c7a897aaafdd099ff4b305e651944eae4e8a76b167c093da5c1ef
Instruction Fuzzy Hash: 38318D716053018FD368DF19C900B26B7E5FB88B04F494A6DE9999B361E7B0F844CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0473AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0473AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0x482d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0x4827b9c; // 0x0
					_t53 = L04754620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E0477B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E0477F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L04746C59(_t53, _t51, _t58) != 0) {
							_t28 = E04765E50(0x471c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E0476B230(_v32, _v28, 0x471c2d8, 1,  &_v24);
								_t28 = E0473F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x0473aa25
0x0473aa29
0x0473aa2d
0x0473aa30
0x0473aa37
0x0473aa3c
0x04794458
0x04794458
0x04794472
0x04794474
0x04794476
0x0473aa64
0x0473aa74
0x0479447c
0x04794483
0x04794492
0x0473aa52
0x0473aa54
0x0473aa5e
0x047944a8
0x047944ad
0x047944af
0x047944b6
0x047944b6
0x047944b9
0x047944bc
0x047944cd
0x047944d3
0x047944d6
0x047944e1
0x047944e1
0x047944e6
0x047944e8
0x047944fb
0x047944fb
0x047944e8
0x00000000
0x0473aa5e
0x04794476
0x0473aa42
0x0473aa46
0x0473aa48
0x0473aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1741f3a9ffb07fee8c68043f06467e11da73b985cc27f98a5983757b8c258882
Instruction ID: 423515f5e3dd25741420b67df148f20bf69de0c23272974df85e2e4fd16c5715
Opcode Fuzzy Hash: 1741f3a9ffb07fee8c68043f06467e11da73b985cc27f98a5983757b8c258882
Instruction Fuzzy Hash: 2B31D172A00219ABDF219F64CE81A7FB7B9EF04704B014469F801EB360E775BD11DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04774A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04774A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0x482d360 ^ _t62;
				_v8 =  *0x482d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E04752280(_t26, 0x4828608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E0474FFB0(_t41, _t51, 0x4828608);
						L2:
						 *0x482b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E0477B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E04752280(_t28, 0x4828608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E0474FFB0(_t42, _t53, 0x4828608);
							if(_t53 != 0) {
								L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E0474FFB0(_t41, _t51, 0x4828608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x04774a2c
0x04774a34
0x04774a3c
0x04774a3e
0x04774a48
0x04774a4b
0x04774a4d
0x04774a51
0x04774a9c
0x00000000
0x00000000
0x04774aa3
0x04774aa8
0x04774aad
0x04774ab1
0x04774ade
0x04774ae3
0x04774a5a
0x04774a62
0x04774a6a
0x04774a6e
0x047af203
0x04774a84
0x04774a88
0x04774a89
0x04774a8a
0x04774a95
0x04774a95
0x04774a79
0x04774a80
0x04774af2
0x04774af4
0x04774af9
0x04774aff
0x04774b01
0x04774b03
0x04774b08
0x047af20a
0x047af212
0x047af216
0x047af216
0x04774b08
0x04774b13
0x04774b1a
0x047af229
0x047af229
0x04774b1a
0x04774a82
0x00000000
0x04774a82
0x04774ab7
0x04774acd
0x04774acd
0x04774ad5
0x04774ada
0x00000000
0x04774ada
0x04774ac2
0x04774acb
0x00000000
0x00000000
0x00000000
0x04774acb
0x04774a53
0x04774a53
0x04774a58
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bc422fc5e5a9d34de2a5fb4b4ddc09b3d891b50952af357bc99f7e0af9dd580
Instruction ID: 606647d0cf7bcfcb617833ac6dd90f38e1fa6241cc064ad088de0ff401be0c4a
Opcode Fuzzy Hash: 0bc422fc5e5a9d34de2a5fb4b4ddc09b3d891b50952af357bc99f7e0af9dd580
Instruction Fuzzy Hash: 1331D1322057509BDF31EF54CA48B2ABBE4FBC0714F864A29E8564B750DB74F940CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04778EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E04778EC7(void* __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int* _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				intOrPtr _v152;
				char _v156;
				intOrPtr _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0x482d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E04764E70(0x48286e4, 0x4779490, 0, 0);
					if( *0x48253e8 > 5 && E04778F33(0x48253e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0x48253e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0x48253e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0x471bc46;
						_t48 = E047B7B9C(0x48253e8, 0x471bc46, _t67, 0x48253e8, _t70,  &_v140);
					}
				}
				return E0477B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x04778ec7
0x04778ed9
0x04778edc
0x04778ee6
0x04778ee9
0x04778eee
0x04778efc
0x04778f08
0x047b1349
0x047b1353
0x047b135d
0x047b1366
0x047b136f
0x047b1375
0x047b137c
0x047b1385
0x047b1390
0x047b1391
0x047b139c
0x047b139d
0x047b13a6
0x047b13ac
0x047b13b2
0x047b13b5
0x047b13bc
0x047b13bf
0x047b13c2
0x047b13c5
0x047b13c8
0x047b13cb
0x047b13ce
0x047b13d1
0x047b13d4
0x047b13d7
0x047b13da
0x047b13dd
0x047b13e0
0x047b13e3
0x047b13e6
0x047b13e9
0x047b13f6
0x047b1400
0x047b1400
0x04778f08
0x04778f32

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8795e9e077908966ac1c100ec19711f3c3dcd5598a83684d073c17728f361af
Instruction ID: 89e32b21a7843c58e6ee4bd98c074b9820952a9bc07b50a8a9ad297576994e63
Opcode Fuzzy Hash: e8795e9e077908966ac1c100ec19711f3c3dcd5598a83684d073c17728f361af
Instruction Fuzzy Hash: 6D4193B1D002189FDB20DFAAD984AAEFBF4FB48314F90416EE549A7740E7746A84CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0476E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E0476E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E04779670() < 0) {
					L0478DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0x4827b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L04754620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M0476E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x0476e730
0x0476e736
0x0476e738
0x0476e73d
0x0476e73e
0x0476e740
0x0476e749
0x0476e765
0x0476e76a
0x0476e76b
0x0476e76c
0x0476e76d
0x0476e76e
0x0476e76f
0x0476e775
0x0476e777
0x0476e77e
0x047ab675
0x0476e784
0x0476e784
0x0476e789
0x0476e7a8
0x0476e7ac
0x0476e807
0x0476e7ae
0x0476e7ae
0x0476e7b1
0x0476e7b4
0x0476e7b9
0x0476e7c0
0x0476e7c4
0x0476e7ca
0x0476e7cc
0x00000000
0x0476e7d3
0x0476e7d6
0x00000000
0x00000000
0x0476e7ff
0x0476e802
0x00000000
0x00000000
0x0476e7f9
0x0476e7fc
0x00000000
0x00000000
0x0476e7f3
0x0476e7f6
0x00000000
0x00000000
0x0476e7ed
0x0476e7f0
0x00000000
0x00000000
0x0476e7e7
0x0476e7ea
0x00000000
0x00000000
0x047ab685
0x047ab688
0x00000000
0x00000000
0x047ab682
0x00000000
0x00000000
0x0476e7cc
0x0476e7d9
0x0476e7dc
0x0476e7de
0x0476e7de
0x0476e7ac
0x0476e7e4
0x0476e74b
0x0476e751
0x0476e759
0x0476e761
0x0476e761

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 654330a0aa2a33baa7fc061f95df6c79020919d43316a37d02de71bb61292d3b
Instruction ID: bc30e714534c2d42c2dd536ae2e82be776bc14a3d79bb445f3d98492510db4be
Opcode Fuzzy Hash: 654330a0aa2a33baa7fc061f95df6c79020919d43316a37d02de71bb61292d3b
Instruction Fuzzy Hash: D2318C79A14249EFE704CF59C844B9AB7E9FB18314F148256F908CB341E631EC90CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0476BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0476BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0x4826100; // 0x1a
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E04752280(0xd, 0x168bf1a0);
				_t41 =  *0x48260f8; // 0x0
				if(_t41 != 0) {
					 *0x48260f8 =  *_t41;
					 *0x48260fc =  *0x48260fc + 0xffff;
				}
				E0474FFB0(_t41, 0x800, 0x168bf1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0x48260f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L04754620(0x4826100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0x4826100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x0476bc36
0x0476bc42
0x0476bc45
0x0476bc4a
0x0476bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x0476bc50
0x0476bc50
0x0476bc58
0x0476bc5a
0x0476bc60
0x00000000
0x00000000
0x047aa4f2
0x047aa4f6
0x00000000
0x00000000
0x00000000
0x047aa4fc
0x0476bc79
0x0476bc7e
0x0476bc86
0x0476bd16
0x0476bd20
0x0476bd20
0x0476bc8d
0x0476bc94
0x0476bcbd
0x0476bcca
0x0476bccb
0x0476bccc
0x0476bccd
0x0476bcce
0x0476bcd4
0x0476bcea
0x0476bcee
0x0476bcf2
0x0476bd00
0x0476bd04
0x00000000
0x0476bc96
0x0476bcab
0x0476bcaf
0x0476bd2c
0x0476bd2c
0x0476bd09
0x00000000
0x0476bd09
0x0476bcb1
0x0476bcb5
0x0476bcbb
0x00000000
0x00000000
0x00000000
0x0476bcbb

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 179fcc50962eca45e7a95617ee55ffa7be8039fd6b5cc20bf5f54c9dc029e595
Instruction ID: 28d1059cde29afb450158b48c832bcddda30d9366bd703b4a7e4cc0f16098781
Opcode Fuzzy Hash: 179fcc50962eca45e7a95617ee55ffa7be8039fd6b5cc20bf5f54c9dc029e595
Instruction Fuzzy Hash: B431FF326006659BDB11EF58C4807A673A5FB1A314F104978ED06EF341FB79FE498B80

Uniqueness

Uniqueness Score: -1.00%

Function 04739100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E04739100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0x480f6e8);
				E0478D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E048088F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E0478D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0x48286c0; // 0x8007b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0x48286b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E04752280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E048088F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E0477AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0x482b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0x48284c0;
										if(_t69 >=  *0x48284c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E04809063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E0473922A(_t82);
							_t53 = E04757D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E04808B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0x48286c0; // 0x8007b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0x48286b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0x48286bc;
										_t72 = 0x48286b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E04739240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0x48286c4;
									_t72 = 0x48286c0;
									L18:
									E04769B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x04739100
0x04739100
0x04739100
0x04739100
0x04739102
0x04739107
0x0473910c
0x04739110
0x04739115
0x04739136
0x04739143
0x047937e4
0x047937e4
0x04739149
0x0473914e
0x0473914e
0x04739117
0x0473911d
0x00000000
0x00000000
0x0473911f
0x04739125
0x00000000
0x04739151
0x04739158
0x0473915d
0x04739161
0x04739168
0x04793715
0x00000000
0x0473916e
0x0473916e
0x04739175
0x04739177
0x0473917e
0x0473917f
0x04739182
0x04739182
0x04739187
0x04739187
0x0473918a
0x0473918d
0x0473918f
0x04739192
0x04739195
0x04739198
0x04739198
0x04739198
0x0473919a
0x00000000
0x00000000
0x0479371f
0x04793721
0x04793727
0x0479372f
0x04793733
0x04793735
0x04793738
0x0479373b
0x0479373d
0x04793740
0x00000000
0x00000000
0x04793746
0x04793749
0x00000000
0x00000000
0x0479374f
0x04793751
0x00000000
0x00000000
0x04793757
0x04793759
0x0479375c
0x0479375c
0x0479375e
0x0479375e
0x04793761
0x04793764
0x00000000
0x00000000
0x04793766
0x04793768
0x047937a3
0x047937a3
0x047937a5
0x047937a7
0x047937ad
0x047937b0
0x047937b2
0x047937bc
0x047937c2
0x047937c2
0x047937b2
0x04739187
0x04739187
0x0473918a
0x0473918d
0x0473918f
0x04739192
0x04739195
0x00000000
0x04739195
0x00000000
0x04739187
0x0479376a
0x0479376a
0x0479376c
0x0479376c
0x0479376f
0x04793775
0x00000000
0x00000000
0x04793777
0x04793779
0x00000000
0x00000000
0x04793782
0x04793787
0x04793789
0x04793790
0x04793790
0x0479378b
0x0479378b
0x0479378b
0x04793792
0x04793795
0x04793795
0x04793798
0x04793798
0x0479379b
0x0479379b
0x047391a3
0x047391a9
0x047391b0
0x047391b4
0x047391b4
0x047391bb
0x047391c0
0x047391c5
0x047391c7
0x047937da
0x047391cd
0x047391cd
0x047391cd
0x047391d2
0x047391d5
0x04739239
0x04739239
0x047391d7
0x047391db
0x047391e1
0x047391e7
0x047391fd
0x04739203
0x0473921e
0x04739223
0x00000000
0x04739223
0x04739205
0x04739208
0x0473920c
0x04739214
0x04739214
0x047391e9
0x047391e9
0x047391ee
0x047391f3
0x047391f3
0x047391f3
0x047391e7
0x00000000
0x047391db
0x04739187
0x04739168

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160dfff46a2657a0de252795a59939642c4e976d022bd8640f82e87bab761286
Instruction ID: 34ba287c1f6c1e56b6a0ee794aa309afc6d4ac503de5f1098689904fa941df89
Opcode Fuzzy Hash: 160dfff46a2657a0de252795a59939642c4e976d022bd8640f82e87bab761286
Instruction Fuzzy Hash: 1931A0F5A01644DFEB25EF68C588BACB7B1BB48315F148649CA0577382D3B5BD80CB51

Uniqueness

Uniqueness Score: -1.00%

Function 04761DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E04761DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E0475F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L04754620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E0475F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x04761dc2
0x04761dc5
0x04761dc7
0x04761dcc
0x04761dce
0x04761dd6
0x04761ddf
0x04761de0
0x04761de1
0x04761de5
0x04761de8
0x04761def
0x04761df0
0x04761df6
0x04761df7
0x04761dfe
0x04761e1a
0x00000000
0x00000000
0x04761e0b
0x04761e12
0x04761e12
0x04761e00
0x04761e00
0x04761e05
0x04761e1e
0x04761e23
0x047a570f
0x047a5713
0x00000000
0x00000000
0x047a5719
0x047a5719
0x04761e2c
0x04761e2d
0x04761e2e
0x04761e2f
0x04761e31
0x04761e32
0x04761e35
0x04761e3d
0x047a5723
0x047a573d
0x047a573d
0x00000000
0x047a5723
0x04761e49
0x04761e4e
0x04761e4e
0x04761e09
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 04e364b29c36692d9976cea9d04f834c0374df58c243179c2fe37670ef778771
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: 4D218072640118AFD721CF69CC88E6ABBBEEF85746F514055E9029B320DA30FD11D790

Uniqueness

Uniqueness Score: -1.00%

Function 04750050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E04750050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0x482d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E04769ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E0477B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E04808A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E04769702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0x482b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x04750055
0x0475005d
0x04750062
0x0475006c
0x0475006f
0x04750074
0x0475007a
0x0475007a
0x04750080
0x04750080
0x04750087
0x0475008d
0x0475008f
0x04750093
0x04750095
0x0475009b
0x047500f8
0x047500fb
0x047500fc
0x047500ff
0x04750108
0x04750108
0x047500a2
0x047500a6
0x047500b3
0x047500bc
0x047500c5
0x047500ca
0x0479c01e
0x00000000
0x00000000
0x0479c02d
0x047500d5
0x047500d9
0x0479c03d
0x0479c046
0x0479c046
0x047500df
0x047500e2
0x047500ea
0x047500ef
0x047500f2
0x047500f6
0x04750111
0x04750117
0x04750117
0x00000000
0x047500f6
0x047500d0
0x047500d0
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d2ad839bb8126f8efbfd46386ad1740f80f5a63b6554f93071869258e0b6cc5
Instruction ID: 0d3c7d3f375cf8813f4283ef3f3abf606364223b66e554e9b955fcbb567f31f2
Opcode Fuzzy Hash: 0d2ad839bb8126f8efbfd46386ad1740f80f5a63b6554f93071869258e0b6cc5
Instruction Fuzzy Hash: 1631A071201B448FDB21CF28C944B56B3E5FF88718F14496DE99A8B7A0EB75BC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 047B6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E047B6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E04757D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0x4827b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L04754620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E0477F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E04757D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E04779AE0();
						_t23 = L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x047b6c0a
0x047b6c0f
0x047b6c10
0x047b6c13
0x047b6c15
0x047b6c19
0x047b6c1c
0x047b6c21
0x047b6c28
0x047b6c3a
0x047b6c2a
0x047b6c33
0x047b6c33
0x047b6c3f
0x047b6c48
0x047b6c4d
0x047b6c60
0x047b6c65
0x047b6c69
0x047b6c73
0x047b6c79
0x047b6c7f
0x047b6c86
0x047b6c90
0x047b6c94
0x047b6ca6
0x047b6cb2
0x047b6cbd
0x047b6cbd
0x047b6cc3
0x047b6cc7
0x047b6ccb
0x047b6cd0
0x047b6cd1
0x047b6ce2
0x047b6ce2
0x047b6c69
0x047b6ced

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b17d4c7d1cb417fed27576fd6359f7cdda87cad08d61577cf483401216c3e1b4
Instruction ID: 47cf477e3dc6508462810404519a2017eb307e3ddf485c1e7b29dab145f6de65
Opcode Fuzzy Hash: b17d4c7d1cb417fed27576fd6359f7cdda87cad08d61577cf483401216c3e1b4
Instruction Fuzzy Hash: 3C21A9B1A00644AFD716DB68D984F6AB7B8FF48704F14006AF908CB7A1E635FD10CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 047790AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E047790AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E0478D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E0476E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L04754620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E0477F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E0476A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x047790af
0x047790b8
0x047790bb
0x047790bf
0x047790c2
0x047790c2
0x047790c8
0x047790cb
0x047790cd
0x047b14d7
0x047b14eb
0x047b14eb
0x00000000
0x047b14eb
0x047b14db
0x047b14e6
0x00000000
0x047b14f2
0x047b14e8
0x00000000
0x047b14e8
0x047790d8
0x047790da
0x047790dd
0x047790e5
0x00000000
0x04779139
0x047790fa
0x047790fe
0x04779142
0x00000000
0x04779142
0x04779104
0x04779107
0x0477910b
0x04779110
0x04779118
0x04779147
0x04779148
0x0477914f
0x04779150
0x04779151
0x04779152
0x04779156
0x0477915d
0x04779160
0x04779168
0x0477916c
0x047791bc
0x047791be
0x00000000
0x047791be
0x0477916e
0x04779173
0x04779176
0x00000000
0x00000000
0x0477917c
0x04779180
0x047791b5
0x00000000
0x047791b5
0x04779182
0x04779185
0x04779189
0x00000000
0x00000000
0x0477918e
0x04779190
0x04779198
0x00000000
0x00000000
0x047791a0
0x00000000
0x047791ad
0x047791ad
0x047791b0
0x047791b1
0x00000000
0x04779185
0x0477911a
0x0477911c
0x0477911f
0x04779125
0x04779127
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: 6aef104fa087db53aa13421b49e6d25ef8fa9ceb6896e05fda7e4ee3a82c600f
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 312153B5A01205EFEB20DF55C944E9AF7F8EB44354F54886AEA49A7350E370FD50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04763B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E04763B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0x48284c4; // 0x0
				_v12 = 1;
				_v8 =  *0x48284c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0x48284c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E0477AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E0477FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0x48284c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0x48284c4; // 0x0
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x04763b89
0x04763b96
0x04763ba1
0x04763bab
0x04763bb5
0x04763bb9
0x047a6298
0x04763bbf
0x04763bc2
0x04763bc3
0x04763bc9
0x04763bca
0x04763bcc
0x04763bcd
0x04763bd4
0x04763bd6
0x04763bdb
0x04763bea
0x04763bf7
0x04763bfb
0x04763bff
0x04763c09
0x04763c0a
0x04763c0b
0x04763c0f
0x04763c14
0x04763c18
0x04763c18
0x04763bfb
0x04763c1b
0x04763c30
0x04763c30
0x04763c3d

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e74595044120fe9f37bf4e920c89f50d09f65cae955a912d64d6b836d7c373
Instruction ID: 0fea319c822a2c9e921a25df04a2aa3df287d515c528c316586e0e7c5ba5e128
Opcode Fuzzy Hash: 38e74595044120fe9f37bf4e920c89f50d09f65cae955a912d64d6b836d7c373
Instruction Fuzzy Hash: 1721BE72A00508AFDB10DF58CE81B6AB7BDFB40308F154568ED09AB351D376BD15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 047B6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E047B6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E04757D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E04757D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0x4715c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E0476F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E0476F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E047B7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L04752400( &_v52);
								}
								_t21 = L04752400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x047b6cfb
0x047b6d00
0x047b6d02
0x047b6d06
0x047b6d0a
0x047b6d0e
0x047b6d19
0x047b6d2b
0x047b6d1b
0x047b6d24
0x047b6d24
0x047b6d33
0x047b6d39
0x047b6d46
0x047b6d4f
0x047b6d61
0x047b6d51
0x047b6d5a
0x047b6d5a
0x047b6d69
0x047b6d6b
0x047b6d6d
0x047b6d6f
0x047b6d6f
0x047b6d74
0x047b6d79
0x047b6d7a
0x047b6d7f
0x047b6d82
0x047b6d88
0x047b6d89
0x047b6d90
0x047b6d94
0x047b6da7
0x047b6db1
0x047b6db1
0x047b6dbb
0x047b6dbb
0x047b6d90
0x047b6d69
0x047b6d46
0x047b6dc6

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2258b011d03e06130897e91094f2d10f38b8bc014e0a90fe0c68a9e1687478c
Instruction ID: 5b0125ff6e7d0fa5ca1d6f2ee61612f0a009df57015d48ed205549c15fc01b3e
Opcode Fuzzy Hash: d2258b011d03e06130897e91094f2d10f38b8bc014e0a90fe0c68a9e1687478c
Instruction Fuzzy Hash: 7121B0725047459BDB11DF69C948BABB7ECAF81744F040966FE80CB361EB34E908C6E2

Uniqueness

Uniqueness Score: -1.00%

Function 04802EF7, Relevance: .1, Instructions: 72
COMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E04802EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x482d360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E0477D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E0477D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E04752280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x482b1e0();
						 *( *(_t106 + 0x30) ^  *0x4826110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x482b1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x4826110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E0474FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E0477B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x471ac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x471ac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x04802efc
0x04802efd
0x04802eff
0x04802f03
0x04802f0a
0x04802f0c
0x04802f15
0x04802fba
0x04802fbb
0x04802fc5
0x04802fcd
0x04802fcf
0x04802fd3
0x04802fd4
0x04802fd5
0x04802fd7
0x04802fda
0x04802fdb
0x04802fdd
0x04802fe0
0x04802fe2
0x04802ffc
0x04802fe4
0x04802fe4
0x04802fea
0x04802fed
0x04802fef
0x04802ff6
0x04802ff1
0x04802ff1
0x04802ff1
0x04802fef
0x04802fff
0x04803001
0x0480301b
0x04803003
0x04803003
0x0480300e
0x04803015
0x04803010
0x04803010
0x04803010
0x04803010
0x0480300e
0x0480302c
0x04803035
0x0480303c
0x04803046
0x0480304e
0x04803056
0x0480305a
0x0480305e
0x04803063
0x04803067
0x0480306b
0x0480306f
0x04803072
0x048030af
0x048030b5
0x048030c1
0x048030c9
0x048030c9
0x048030c9
0x00000000
0x04803074
0x04803081
0x04803089
0x0480308b
0x0480308d
0x04803093
0x0480309a
0x048030ce
0x048030d1
0x048030d5
0x048030d5
0x048030d5
0x0480308d
0x048030db
0x048030e6
0x048030e7
0x048030e8
0x048030e9
0x048030f3
0x04802f27
0x04802f29
0x04802f2b
0x04802f2d
0x04802f36
0x04802f3d
0x04802f4c
0x04802f58
0x04802fad
0x04802fb7
0x04802fb7

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e6bedb48a5f46dd5bf3d3817c11c2998a64b45fb2beb543e4952b0b4a57eb80
Instruction ID: 0a9511639751e65b3273c7777f05880c65d1e81dbd330cef8c29b3042dece375
Opcode Fuzzy Hash: 4e6bedb48a5f46dd5bf3d3817c11c2998a64b45fb2beb543e4952b0b4a57eb80
Instruction Fuzzy Hash: E221B7752041901FD749CF1EC8A09B6BFE5EFC612235AC1F5E988CB752C528D81AC7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0480070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0480070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E048007DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E047FAFDE( &_v8,  &_v12);
					E04801293(_t38, _v28, _t60);
					if(E04757D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E047F14FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x0480071b
0x04800724
0x04800734
0x04800738
0x0480074b
0x0480074b
0x04800753
0x04800753
0x04800759
0x0480075d
0x04800774
0x04800779
0x0480077d
0x04800789
0x04800795
0x048007a7
0x04800797
0x048007a0
0x048007a0
0x048007af
0x048007c4
0x048007cd
0x048007cd
0x048007af
0x048007dc

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: 2f9846f8d234706aeb6ac6e83dd14eaa4162a5cd293d65898299b0aaeff82f75
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: AF2104362082049FE705DF18DC84B6ABBA5EFC5354F04CA69F9958B381DB34E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0475AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0475AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E04757D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E04757D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E04757D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E04757D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E047B7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x0475ae78
0x0475ae7c
0x0475ae7e
0x0475ae81
0x0475ae86
0x0475ae8d
0x047a2691
0x0475ae93
0x0475ae93
0x0475ae93
0x0475ae98
0x0475ae9d
0x047a26a2
0x047a26b4
0x047a26a4
0x047a26ad
0x047a26ad
0x047a26b9
0x00000000
0x047a26bb
0x00000000
0x047a26bb
0x0475aea3
0x0475aea3
0x0475aea3
0x0475aeaa
0x047a26c0
0x047a26c9
0x047a26c9
0x0475aeb3
0x047a26d4
0x047a26e1
0x00000000
0x00000000
0x047a26e7
0x047a26ee
0x047a26f0
0x047a26f9
0x047a26f9
0x047a2702
0x047a2708
0x047a2708
0x047a270b
0x047a270f
0x047a2711
0x047a2711
0x047a2725
0x047a2725
0x00000000
0x0475aeb9
0x0475aeb9
0x0475aebf
0x0475aebf
0x0475aeb3

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: 37a232e7e646d8592e230dcf40d26a93192f6b8b80b760fb39c44ce1118d5490
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 3221D4316026849FEB169B29C948B2577E8EF84344F1D02E1DD048FBB2E7B4FC50C690

Uniqueness

Uniqueness Score: -1.00%

Function 04801FF1, Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E04801FF1(void* __ecx, intOrPtr __edx, signed int _a4) {
				intOrPtr _v8;
				signed int _t22;
				signed int _t34;
				signed int _t38;
				signed int _t41;
				signed int _t42;
				signed int _t44;
				signed int _t54;
				signed int _t55;

				_t44 = _a4;
				_v8 = __edx;
				_t3 = _t44 + 0x1007; // 0x1007
				_t41 = _t3 & 0xfffff000;
				_t54 = ( *_t44 ^  *0x4826110 ^ _t44) >> 0x00000001 & 0x00007fff;
				if(_t41 - _t44 < _t54 << 3) {
					_t42 = _t41 + 0xfffffff0;
					_t34 = _t42 - _t44 >> 3;
					_t55 = _t54 - _t34;
					 *_t44 =  *_t44 ^ (_t34 + _t34 ^  *_t44 ^  *0x4826110 ^ _t44) & 0x0000fffe;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_t22 = ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff) + ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff);
					 *_t42 = _t22;
					_t38 = _t42 + _t55 * 8;
					 *_t42 = _t22 ^  *0x4826110 ^ _t42;
					if(_t38 < _v8 + (( *(_v8 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t38 =  *_t38 ^ (_t55 << 0x00000010 ^  *0x4826110 ^ _t38 ^  *_t38) & 0x7fff0000;
					}
				} else {
					_t42 = 0;
				}
				return _t42;
			}

0x04801ff9
0x04801ffc
0x04802001
0x0480200d
0x0480201b
0x04802028
0x0480202e
0x04802035
0x04802038
0x0480204c
0x04802052
0x04802053
0x04802054
0x04802055
0x04802069
0x0480206c
0x0480206e
0x04802079
0x04802087
0x0480209c
0x0480209c
0x0480202a
0x0480202a
0x0480202a
0x048020a5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c48972fe9397339a2f477cc820b6855fb111ea15ad89dbf34ea9d046573a1293
Instruction ID: 8482df08b8cb2cebfbba89bacd5f5e5ea351439309b1201b47629cf377439221
Opcode Fuzzy Hash: c48972fe9397339a2f477cc820b6855fb111ea15ad89dbf34ea9d046573a1293
Instruction Fuzzy Hash: 0B21A533A105159B9758CF7CC805566F7E6EF8C31032A8ABAD812FB295EA71BD11C680

Uniqueness

Uniqueness Score: -1.00%

Function 047B7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E047B7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0x4827b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E0477F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E04757D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E04779AE0();
					_t24 = L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x047b7799
0x047b779a
0x047b779b
0x047b77a3
0x047b77ab
0x047b77ae
0x047b77b1
0x047b77b1
0x047b77bf
0x047b77c4
0x047b77c8
0x047b77ce
0x047b77d4
0x047b77e0
0x047b77e0
0x047b77d6
0x047b77d6
0x047b77de
0x00000000
0x00000000
0x047b77de
0x047b77e5
0x047b77f0
0x047b77f3
0x047b77f6
0x047b77fd
0x047b7800
0x047b780c
0x047b7818
0x047b782b
0x047b781a
0x047b7823
0x047b7823
0x047b7830
0x047b7831
0x047b7838
0x047b783d
0x047b783e
0x047b784f
0x047b784f
0x047b785a

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62946d67c6434987a43a3665a9d5968ce1f3e2eaf11cda302d018ca26d307c99
Instruction ID: 833847b135aed8889aaad9815fa8b276cc3e41ec60a0df0313d121dc6bf9f682
Opcode Fuzzy Hash: 62946d67c6434987a43a3665a9d5968ce1f3e2eaf11cda302d018ca26d307c99
Instruction Fuzzy Hash: D621A172501604ABC729DF69D884FABB7BCEF88340F10456DF94ACB760D634E900CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0476FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0476FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E047476E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x0476fd9b
0x0476fda0
0x0476fda1
0x0476fdab
0x0476fdad
0x0476fdb0
0x0476fdb8
0x0476fe0f
0x0476fde6
0x0476fde9
0x0476fdec
0x047ac0c0
0x0476fdfe
0x0476fe06
0x0476fe06
0x047ac0c8
0x0476fe2d
0x0476fe2d
0x00000000
0x0476fe2d
0x047ac0d1
0x047ac0e0
0x047ac0e5
0x047ac0e5
0x047ac0e8
0x00000000
0x047ac0e8
0x0476fdf4
0x00000000
0x00000000
0x0476fdf6
0x0476fdfa
0x0476fe1a
0x0476fe1f
0x0476fe1f
0x0476fdfc
0x00000000
0x0476fdfc
0x0476fdcc
0x0476fdd0
0x0476fe26
0x00000000
0x0476fe26
0x0476fdd8
0x0476fddb
0x0476fddd
0x0476fde0
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: e23925c0797394b1baf55656c41e6ceb0aaaed0ac9ab409b9b1baaefbdf471d1
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: F5217C72601A40DFD735CF1AE540A66BBE6EB94B10F24856EE9468B714E731BC00DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0474841F, Relevance: .1, Instructions: 64
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E0474841F(signed int __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _t43;
				signed int _t46;
				signed int _t50;
				signed int _t57;
				signed int _t64;

				_v16 = __ecx;
				_t43 =  *0x7ffe0004;
				_v8 = _t43;
				_t57 =  *0x7ffe0014 ^  *( *[fs:0x18] + 0x24) ^  *( *[fs:0x18] + 0x20) ^  *0x7ffe0018;
				_v12 = 0x7ffe0014;
				if(_t43 < 0x1000000) {
					while(1) {
						_t46 =  *0x7ffe0324;
						_t50 =  *0x7FFE0320;
						if(_t46 ==  *0x7FFE0328) {
							break;
						}
						asm("pause");
					}
					_t57 = _v12;
					_t64 = ((_t50 * _v8 >> 0x00000020 << 0x00000020 | _t50 * _v8) >> 0x18) + (_t46 << 8) * _v8;
				} else {
					_t64 = ( *0x7ffe0320 * _t43 >> 0x00000020 << 0x00000020 | 0x7ffe0320 * _t43) >> 0x18;
				}
				_push(0);
				_push( &_v24);
				E04779810();
				return _t64 ^ _v20 ^ _v24 ^ _t57 ^ _v16;
			}

0x0474842f
0x04748448
0x0474844e
0x04748459
0x0474845b
0x04748464
0x04799ac3
0x04799ac3
0x04799ac5
0x04799acb
0x00000000
0x00000000
0x04799acd
0x04799acd
0x04799ad1
0x04799ae9
0x0474846a
0x04748475
0x04748479
0x0474847c
0x04748481
0x04748482
0x0474849a

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction ID: be64d053ad12731d5a177745b9a33648d31a64d9e7cffacce211f530c765e6ad
Opcode Fuzzy Hash: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction Fuzzy Hash: AE2160B6E00119DBDB14CFA9C58069AF3F5FB88350FA64569EA59B7344D630AE04CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 04739240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E04739240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0x480f708);
				E0478D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E047795D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E047795D0();
				_t33 =  *0x48284c4; // 0x0
				L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0x48284c4; // 0x0
				L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0x48284c4; // 0x0
				E04752280(L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0x48286b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E047795D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E047795D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E04739325();
					_t50 =  *0x48284c4; // 0x0
					return E0478D0D1(L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x04739240
0x04739242
0x04739247
0x0473924c
0x0473924e
0x04739255
0x04739257
0x0473925a
0x0473925f
0x0473925f
0x04739266
0x04739271
0x04739276
0x04739279
0x0473927e
0x04739295
0x0473929a
0x047392b1
0x047392b6
0x047392d7
0x047392dc
0x047392e0
0x047392e6
0x047392e8
0x047392ee
0x04739332
0x04739333
0x04739337
0x04739338
0x0473933a
0x0473933a
0x0473933d
0x04739342
0x04739342
0x04739345
0x04739349
0x0473934e
0x04739352
0x04739357
0x047392f4
0x047392f4
0x047392f6
0x047392f9
0x04739300
0x04739306
0x04739324
0x04739324

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 777b7a0bcecddb35d8138082c54abc8ee607bea661fc2e2faa73ffe76e64822c
Instruction ID: 5d938b9160b48ba60b9b1d38042d3cbf8eff8652a49a4306f771fe58c56f8a49
Opcode Fuzzy Hash: 777b7a0bcecddb35d8138082c54abc8ee607bea661fc2e2faa73ffe76e64822c
Instruction Fuzzy Hash: 83214AB1041A00DFD725EF28CA44F55B7B9FF08708F048A68A149967B2CB75F941CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0476B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0476B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E04752280(_t12, 0x4828608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E047700C2(0x4828608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x0476b395
0x0476b3a2
0x0476b3a5
0x0476b3aa
0x0476b3b2
0x0476b3ba
0x0476b3bd
0x0476b3c0
0x0476b3c4
0x0476b3c9
0x047aa3e9
0x047aa3ed
0x047aa3f0
0x047aa3ff
0x047aa403
0x047aa409
0x00000000
0x00000000
0x047aa40b
0x047aa40b
0x047aa40f
0x047aa415
0x047aa423
0x047aa423
0x047aa415
0x0476b3d1
0x0476b3e8
0x0476b3e8
0x0476b3d9

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d30268e5e6df3a9402a2f03334a5b8d3c3c488da68c0318542428bf5c8bab0f
Instruction ID: dea86dea26f9e94f4d0984ae0d222086575f4467708fb1740dff3f3ad464abd8
Opcode Fuzzy Hash: 1d30268e5e6df3a9402a2f03334a5b8d3c3c488da68c0318542428bf5c8bab0f
Instruction Fuzzy Hash: DA1148333012209BDB289A1ADE81A6B7397EBC6330B250629DE17DB390D931BC02C790

Uniqueness

Uniqueness Score: -1.00%

Function 047C4257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E047C4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0x48108d0);
				E0478D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E047C41E8(__ebx, __edi, __ecx, _t39);
				E0474EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0x48287e4;
					_t18 =  *0x48287e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0x4825cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0x48287e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0x48287e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L04737055(_t31 + 0xfffffff8);
								_t24 =  *0x48287e0; // 0x0
								_t18 = _t24 - 1;
								 *0x48287e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0x4825cd0;
				if( *0x4825cd0 <= 0) {
					L04737055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0x48287e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0x48287e8 = _t30;
						 *0x48287e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E0478D0D1(L047C4320());
			}

0x047c4257
0x047c4257
0x047c4257
0x047c4259
0x047c425e
0x047c4263
0x047c4265
0x047c4273
0x047c4278
0x047c427c
0x047c427f
0x047c4281
0x047c4287
0x047c42d7
0x047c42d7
0x047c42da
0x047c428d
0x047c428d
0x047c428f
0x047c4292
0x047c4297
0x047c429c
0x047c42a0
0x047c42a6
0x047c42a8
0x047c42ae
0x047c42b3
0x00000000
0x047c42ba
0x047c42ba
0x047c42bf
0x047c42c5
0x047c42ca
0x047c42cf
0x047c42d0
0x00000000
0x047c42d0
0x047c42b3
0x00000000
0x047c42a6
0x047c429c
0x047c42dc
0x047c42dc
0x047c42e3
0x047c4309
0x047c42e5
0x047c42e5
0x047c42e8
0x047c42ee
0x047c42f0
0x00000000
0x047c42f2
0x047c42f2
0x047c42f4
0x047c42f7
0x047c42f9
0x047c4300
0x047c4300
0x047c42f0
0x047c430e
0x047c431f

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da2795ac1f3052e624ddb6691f0f555a8fb45cf768ad625dec7c62827b840f96
Instruction ID: c7a140cd3a0c7f562eda6c5f9d1b9dad82caadd634131b7e1104e82ddae4974d
Opcode Fuzzy Hash: da2795ac1f3052e624ddb6691f0f555a8fb45cf768ad625dec7c62827b840f96
Instruction Fuzzy Hash: 87218C71901600DFDB24EF65D624A14BBF1FB85329B90CA6EC1458B391EB3AE881CB40

Uniqueness

Uniqueness Score: -1.00%

Function 047B46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E047B46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E0477F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E0476D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L047577F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x047b46b7
0x047b46ba
0x047b46c5
0x047b46c8
0x047b46d0
0x047b46d4
0x047b46e6
0x047b46e9
0x047b46f4
0x047b46ff
0x047b4705
0x047b4706
0x047b470c
0x047b4713
0x047b471b
0x047b4723
0x047b4725
0x047b46d6
0x047b46d9
0x047b46db
0x047b46db
0x047b4732

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 28a00686d10ff4d5f4d0d7f5f7f1388ac073bb7d94c629bc2f81e84cfb17dfd8
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 4F110272604208BBDB059F5CD8809BEBBB9EF85304F10806AFD848B351DA329D51D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 04762397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E04762397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0x482848c != 0) {
					L0475FAD0(0x4828610);
					if( *0x482848c == 0) {
						E0475FA00(0x4828610, _t19, _t27, 0x4828610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E04762581(0x4828610, 0x47150a0, _t26, _t27, _t28);
						E0475FA00(0x4828610, 0x47150a0, _t27, 0x4828610);
					}
				} else {
					L1:
					_t11 =  *0x4828614; // 0x1
					if(_t11 == 0) {
						_t11 = E04774886(0x4711088, 1, 0x4828614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E04762581(0x4828610, (_t11 << 4) + 0x4715070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x047623b0
0x047623b6
0x04762409
0x04762415
0x047a5ae9
0x00000000
0x0476241b
0x0476241b
0x0476241d
0x04762427
0x0476242e
0x04762430
0x04762430
0x047623b8
0x047623b8
0x047623b8
0x047623bf
0x047623fc
0x047623fc
0x047623c1
0x047623c3
0x047623d0
0x047623d8
0x047623d8
0x047623dc
0x047623de
0x047623e1
0x047623e1
0x047623ec

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab1cb99ad5e2ba6599d40af204169652bd149377791690658bd031277853f23
Instruction ID: fcaa197de9ed6b46d428ad02e29bbc261ec2c8ef0ad7e1ab4fe779eafcdbc65a
Opcode Fuzzy Hash: bab1cb99ad5e2ba6599d40af204169652bd149377791690658bd031277853f23
Instruction Fuzzy Hash: FD11083170031067F770BA7EAD48B15B78EEB90714F1489A6EE03EB362DAB4F9408755

Uniqueness

Uniqueness Score: -1.00%

Function 0473C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E0473C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0x482d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E0474EEF0(0x48270a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E047BF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E0474EB70(_t29, 0x48270a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E0477B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E047BF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0x48270c0; // 0x0
					while(_t38 != 0x48270c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0x482b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x0473c96a
0x0473c974
0x0473c988
0x0473c98a
0x047a7c9d
0x047a7c9f
0x047a7ca4
0x047a7cae
0x047a7cf0
0x047a7cf5
0x047a7cfa
0x0473c992
0x0473c996
0x0473c997
0x0473c998
0x0473c9a3
0x0473c9a3
0x047a7cb0
0x047a7cb7
0x047a7cbb
0x00000000
0x00000000
0x047a7cbd
0x047a7ce8
0x047a7cc5
0x047a7cc8
0x047a7cca
0x047a7cd0
0x047a7cd6
0x047a7cde
0x047a7ce4
0x047a7ce4
0x047a7cd0
0x00000000
0x047a7ce8
0x0473c990
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b6622797b4b19f6177980ee29be3c3e2a9e36798eb9da2c713a741ebe7ca41
Instruction ID: 2da721ab2b30fae2d81e51382fee4c152234b2b06b1aa8b4f8046dd933a8c197
Opcode Fuzzy Hash: 54b6622797b4b19f6177980ee29be3c3e2a9e36798eb9da2c713a741ebe7ca41
Instruction Fuzzy Hash: 5A11C2323006169BD724AF69CD89A6B77E9FBC8618F000A29E941D3750EB24FD68D7D1

Uniqueness

Uniqueness Score: -1.00%

Function 047737F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E047737F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E04752280(_t6, 0x4828550);
				}
				_t29 = E0477387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E0474FFB0(0x4828550, _t27, 0x4828550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x047737fa
0x047737fc
0x04773805
0x04773808
0x04773808
0x04773814
0x04773818
0x04773846
0x04773848
0x0477384b
0x0477384b
0x04773852
0x00000000
0x04773854
0x04773856
0x00000000
0x00000000
0x04773863
0x00000000
0x04773863
0x0477381a
0x0477381a
0x0477381f
0x0477386e
0x0477386e
0x04773871
0x04773873
0x04773873
0x04773868
0x00000000
0x04773868
0x04773821
0x04773826
0x00000000
0x00000000
0x04773828
0x0477382a
0x04773841
0x00000000
0x04773841

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca76a809ac82fc8e0f35307a04298cde8e80a8b0727025487579eeaa1892eea
Instruction ID: 36ce877353466b9a17580edac43d059e44d09d38e05558d8774aaa73ae1bf9a0
Opcode Fuzzy Hash: 9ca76a809ac82fc8e0f35307a04298cde8e80a8b0727025487579eeaa1892eea
Instruction Fuzzy Hash: DF0126B2A016109BDB378F5ADA00E26BBA6DF81B54755446AEC058B311DB38F801D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0476002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0476002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E04757D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E04757D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E04757D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E04757D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x04760032
0x04760037
0x04760043
0x047a4b3a
0x04760049
0x04760049
0x04760049
0x0476004e
0x04760053
0x047a4b48
0x047a4b5a
0x047a4b4a
0x047a4b53
0x047a4b53
0x047a4b5f
0x00000000
0x047a4b61
0x00000000
0x047a4b61
0x04760059
0x04760059
0x04760060
0x047a4b6f
0x047a4b6f
0x04760069
0x047a4b83
0x00000000
0x00000000
0x047a4b90
0x047a4b9b
0x047a4b9b
0x047a4ba4
0x00000000
0x00000000
0x047a4baa
0x00000000
0x0476006f
0x0476006f
0x00000000
0x0476006f
0x04760069

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: aec8da54e6c4b7e926acba721e55e995873371c8b9905370c552a3f52cc50487
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: C21104327016C0CFE722CB29CD48B3577D9EF80758F0900A0DD069BBA2E3AAF855C261

Uniqueness

Uniqueness Score: -1.00%

Function 0474766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0474766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E0476F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E0476F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L04754620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x04747672
0x0474767f
0x04747689
0x047476de
0x047476de
0x0474768b
0x04747691
0x04747693
0x04747697
0x00000000
0x04747699
0x047476a8
0x00000000
0x047476aa
0x047476ad
0x047476b1
0x00000000
0x047476b3
0x047476b3
0x047476b5
0x047476ba
0x047476bc
0x047476bc
0x047476c0
0x00000000
0x047476c2
0x047476ce
0x047476ce
0x047476c0
0x047476b1
0x047476a8
0x04747697
0x047476d9

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: 51bc464ba8596e51852d3b7ee2bd8843f8f34b0e84b6cf1dc339f2ffff3d5ad7
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: 8801DF32300118AFD764AE6ECC84EAB77AEEBC4B60B240524FD19CB350DB30EC1187A1

Uniqueness

Uniqueness Score: -1.00%

Function 047CC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E047CC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E04779910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E047795B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E047795D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E047795D0();
				return L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x047cc458
0x047cc45d
0x047cc466
0x047cc468
0x047cc469
0x047cc46a
0x047cc46b
0x047cc46e
0x047cc46f
0x047cc471
0x047cc476
0x047cc476
0x047cc47c
0x047cc47e
0x047cc480
0x047cc480
0x047cc483
0x047cc484
0x047cc486
0x047cc488
0x047cc48f
0x047cc491
0x047cc493
0x047cc493
0x047cc48f
0x047cc498
0x047cc49e
0x047cc4ad
0x047cc4ad
0x047cc4b2
0x047cc4b4
0x047cc4cd

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: cc32c5d8bb0070e8d2eda7bc4b925cdf83776648b8700083f81f31dede170785
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: DA0180B2140505BFFA26AF65CC84E62BB7DFB54394F508529F214566A0CB21BCA1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04739080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E04739080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0x48285ec;
				E04752280(_t48, 0x48285ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E0474FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0x482538c; // 0x776f6888
					if( *_t84 != 0x4825388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0x480f6e8);
						E0478D0E8(0x48285ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E048088F5(_t80, _t85, 0x4825388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0x48286c0; // 0x8007b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0x48286b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E04752280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E048088F5(0x48285ec, _t85, 0x4825388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E0477AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0x482b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0x48284c0;
																			if(_t82 >=  *0x48284c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E04809063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E0473922A(_t99);
										_t64 = E04757D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E04808B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0x48286c0; // 0x8007b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0x48286b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0x48286bc;
													_t87 = 0x48286b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E04739240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0x48286c4;
												_t87 = 0x48286c0;
												L27:
												E04769B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E0478D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0x4825388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0x482538c = _t51;
						goto L6;
					}
				}
			}

0x04739082
0x04739083
0x04739084
0x04739085
0x04739087
0x04739096
0x04739098
0x04739098
0x0473909e
0x047390a8
0x047390e7
0x047390e7
0x047390aa
0x047390b0
0x047390b7
0x047390bd
0x047390dd
0x047390e6
0x047390bf
0x047390bf
0x047390c7
0x047390cf
0x047390f1
0x047390f2
0x047390f4
0x047390f5
0x047390f6
0x047390f7
0x047390f8
0x047390f9
0x047390fa
0x047390fb
0x047390fc
0x047390fd
0x047390fe
0x047390ff
0x04739100
0x04739102
0x04739107
0x0473910c
0x04739110
0x04739113
0x04739115
0x04739136
0x0473913f
0x04739143
0x047937e4
0x047937e4
0x04739117
0x04739117
0x0473911d
0x00000000
0x0473911f
0x0473911f
0x04739125
0x00000000
0x04739127
0x0473912d
0x04739130
0x04739134
0x04739158
0x0473915d
0x04739161
0x04739168
0x04793715
0x0473916e
0x0473916e
0x04739175
0x04739177
0x0473917e
0x0473917f
0x04739182
0x04739182
0x04739187
0x04739187
0x0473918a
0x0473918d
0x0473918f
0x04739192
0x04739195
0x04739198
0x04739198
0x04739198
0x0473919a
0x00000000
0x00000000
0x0479371f
0x04793721
0x04793727
0x0479372f
0x04793733
0x04793735
0x04793738
0x0479373b
0x0479373d
0x04793740
0x00000000
0x04793746
0x04793746
0x04793749
0x00000000
0x0479374f
0x0479374f
0x04793751
0x04793757
0x04793759
0x0479375c
0x0479375c
0x0479375e
0x0479375e
0x04793761
0x04793764
0x00000000
0x00000000
0x04793766
0x04793768
0x047937a3
0x047937a3
0x047937a5
0x047937a7
0x047937ad
0x047937b0
0x047937b2
0x047937bc
0x047937c2
0x047937c2
0x047937b2
0x04739187
0x04739187
0x0473918a
0x0473918d
0x0473918f
0x04739192
0x04739195
0x00000000
0x04739195
0x00000000
0x0479376a
0x0479376a
0x0479376a
0x0479376c
0x0479376c
0x0479376f
0x04793775
0x00000000
0x00000000
0x04793777
0x04793779
0x04793782
0x04793787
0x04793789
0x04793790
0x04793790
0x0479378b
0x0479378b
0x0479378b
0x04793792
0x04793795
0x00000000
0x04793795
0x00000000
0x04793779
0x04793798
0x00000000
0x04793798
0x00000000
0x04793768
0x0479379b
0x0479379b
0x04793751
0x04793749
0x00000000
0x04793740
0x047391a0
0x047391a3
0x047391a9
0x047391b0
0x00000000
0x047391b0
0x04739187
0x047391b4
0x047391b4
0x047391bb
0x047391c0
0x047391c5
0x047391c7
0x047937da
0x047391cd
0x047391cd
0x047391cd
0x047391d2
0x047391d5
0x04739239
0x04739239
0x047391d7
0x047391db
0x047391e1
0x047391e7
0x047391fd
0x04739203
0x0473921e
0x04739223
0x00000000
0x04739205
0x04739205
0x04739208
0x0473920c
0x04739214
0x04739214
0x0473920c
0x047391e9
0x047391e9
0x047391ee
0x047391f3
0x047391f3
0x047391f3
0x047391e7
0x00000000
0x00000000
0x00000000
0x04739134
0x04739125
0x0473911d
0x0473914e
0x047390d1
0x047390d1
0x047390d3
0x047390d6
0x047390d8
0x00000000
0x047390d8
0x047390cf

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560f7985ae840983a48fbe0937ab0a5f1ea6f9fa246b36de13a762245da2ebd2
Instruction ID: 83503d8ec879aa9307b7cf0244c4be64287ff0a09496762039b5e12e980f8b38
Opcode Fuzzy Hash: 560f7985ae840983a48fbe0937ab0a5f1ea6f9fa246b36de13a762245da2ebd2
Instruction Fuzzy Hash: B901F9F25016059FE3259F08D944B1277A5EB42325F214966D601DB752C3B5FC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04804015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E04804015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E04752280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E04752280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0x48286ac);
					E0473F900(0x48286d4, _t28);
					E0474FFB0(0x48286ac, _t28, 0x48286ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E0474FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x0480401a
0x0480401e
0x04804023
0x04804028
0x04804029
0x0480402b
0x0480402f
0x04804043
0x04804046
0x04804051
0x04804057
0x0480405f
0x04804062
0x04804067
0x0480406f
0x0480407c
0x0480407c
0x0480408c
0x0480408c
0x04804097

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34871af62023c6ba0dd15d5d7d47d6f31a105ab02ca2aa42afab43cb3d60adc7
Instruction ID: 7e8af16fec602c0ea967aaba779fb255dec90a7c9e928ad35215457ba494ad3d
Opcode Fuzzy Hash: 34871af62023c6ba0dd15d5d7d47d6f31a105ab02ca2aa42afab43cb3d60adc7
Instruction Fuzzy Hash: 7001D4712416457FE750BB69CE88E23B7ACEF45658B000B25F908C7B22CB64FC11CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 047F14FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E047F14FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x482d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0477FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E04757D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0477B640(E04779AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x047f14fb
0x047f14fb
0x047f150a
0x047f1514
0x047f1519
0x047f151b
0x047f1526
0x047f152c
0x047f1534
0x047f1537
0x047f153a
0x047f1545
0x047f1557
0x047f1547
0x047f1550
0x047f1550
0x047f1562
0x047f1563
0x047f1565
0x047f156a
0x047f157f

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e1f50d671d485f69d8e844be1ee594b18457d405b43e23decae8cfc483187b7
Instruction ID: 0423b2fbb0842bd75a0e2bf545d38c45d60851ac3dbf28b9e959900b6efbd72d
Opcode Fuzzy Hash: 5e1f50d671d485f69d8e844be1ee594b18457d405b43e23decae8cfc483187b7
Instruction Fuzzy Hash: A5017571A01258EFDB14DF69D845EAEBBB8EF45714F404066F915EB380D674EE00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 047F138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E047F138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0x482d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E0477FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E04757D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0477B640(E04779AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x047f138a
0x047f138a
0x047f1399
0x047f13a3
0x047f13a8
0x047f13aa
0x047f13b5
0x047f13bb
0x047f13c3
0x047f13c6
0x047f13c9
0x047f13d4
0x047f13e6
0x047f13d6
0x047f13df
0x047f13df
0x047f13f1
0x047f13f2
0x047f13f4
0x047f13f9
0x047f140e

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fc0d389f1f1995215f3650d45af1b9bee4b0ed63a7c4581adb46acd1d5248fa
Instruction ID: 3652e0df0c6840cbf79891acf1b4f952f73c033b32a5c3829d4cb43ebe2b6a01
Opcode Fuzzy Hash: 6fc0d389f1f1995215f3650d45af1b9bee4b0ed63a7c4581adb46acd1d5248fa
Instruction Fuzzy Hash: 5D015271A01218AFDB14DFA9D945EAEBBB8EF44714F404066F904EB380E674AE05C795

Uniqueness

Uniqueness Score: -1.00%

Function 047358EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E047358EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0x482d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0x4715c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E04735943() != 0 &&  *0x4825320 > 5) {
					E047B7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E047B7B5E( &_v28, _t28);
					_t11 = E047B7B9C(0x4825320, 0x471bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E0477B640(_t11, _t17, _v8 ^ _t29, 0x471bf15, _t27, _t28);
			}

0x047358fb
0x047358fe
0x04735906
0x0473590a
0x0473593c
0x0473593c
0x0473590c
0x0473590c
0x04735911
0x00000000
0x04735913
0x04735913
0x04735913
0x04735911
0x0473591d
0x04791035
0x0479103c
0x0479103f
0x04791056
0x04791056
0x0473593b

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62351a2a045925127a3e664a39354f576febbe6aa4885551c7cd40478212bb6e
Instruction ID: f21bb3a23a53523325126ba1ce0d36ad7b4a853fb8012ffe46130423c118fdca
Opcode Fuzzy Hash: 62351a2a045925127a3e664a39354f576febbe6aa4885551c7cd40478212bb6e
Instruction Fuzzy Hash: 3801A231B00118BBEB18EE29D918ABF77A8EF84238F9540699905E7345EE31FD06C690

Uniqueness

Uniqueness Score: -1.00%

Function 0474B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0474B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E04757D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E047B7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x0474b037
0x0474b039
0x0474b03b
0x0474b040
0x0479a60e
0x00000000
0x00000000
0x0479a61d
0x0474b04b
0x0474b04e
0x0479a627
0x0479a634
0x00000000
0x00000000
0x0479a641
0x0479a653
0x0479a643
0x0479a64c
0x0479a64c
0x0479a65b
0x00000000
0x00000000
0x00000000
0x0479a66c
0x0474b057
0x0474b057
0x0474b057
0x0474b046
0x0474b046
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: db37d9d1ef61b9042e8ddbb9096f4ec55b8616bceee190b43372660cfc0c3898
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 7C017C32201A809FD726CB5DD988F7677E8EB85754F0A04A1F919CBB61E768FC40C621

Uniqueness

Uniqueness Score: -1.00%

Function 04801074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04801074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E0480165E(__ebx, 0x4828ae4, (__edx -  *0x4828b04 >> 0x14) + (__edx -  *0x4828b04 >> 0x14), __edi, __ecx, (__edx -  *0x4828b04 >> 0x14) + (__edx -  *0x4828b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E047FAFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E04757D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E047EFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x04801074
0x04801080
0x04801082
0x0480108a
0x0480108f
0x04801093
0x048010ab
0x048010ab
0x048010c3
0x048010cf
0x048010e1
0x048010d1
0x048010da
0x048010da
0x048010e9
0x048010f5
0x048010f5
0x048010fe

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 902453230876e40ce90ed9e5fc5c73151186d1a1220b34ab029ae3e4863bce49
Instruction ID: 183cae1d77ab7d915bbebf05de468143e14f19668e2c33c270255603d32b4b44
Opcode Fuzzy Hash: 902453230876e40ce90ed9e5fc5c73151186d1a1220b34ab029ae3e4863bce49
Instruction Fuzzy Hash: CB01F572614741ABD750EB28CD48A1A77D5AB84324F04CB29F886D3790EE72F940CB92

Uniqueness

Uniqueness Score: -1.00%

Function 047EFE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E047EFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x482d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0477FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E04757D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0477B640(E04779AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x047efe3f
0x047efe3f
0x047efe4e
0x047efe58
0x047efe5d
0x047efe5f
0x047efe6a
0x047efe72
0x047efe75
0x047efe78
0x047efe83
0x047efe95
0x047efe85
0x047efe8e
0x047efe8e
0x047efea0
0x047efea1
0x047efea3
0x047efea8
0x047efebd

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8afdff5a5b0587b7c086543075f57a5eab968c3e325208a5ce839026360b88
Instruction ID: e9fb909aaa4e97ab5cc2d8a1d7243189d6963e1df1450008b2c5bc3012850ea2
Opcode Fuzzy Hash: 3c8afdff5a5b0587b7c086543075f57a5eab968c3e325208a5ce839026360b88
Instruction Fuzzy Hash: BA018471E01208ABDB14DFA9D845FAEBBB8EF44704F404066F900EB391DA74AA01C794

Uniqueness

Uniqueness Score: -1.00%

Function 047EFEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E047EFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0x482d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E0477FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E04757D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0477B640(E04779AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x047efec0
0x047efec0
0x047efecf
0x047efed9
0x047efede
0x047efee0
0x047efeeb
0x047efef3
0x047efef6
0x047efef9
0x047eff04
0x047eff16
0x047eff06
0x047eff0f
0x047eff0f
0x047eff21
0x047eff22
0x047eff24
0x047eff29
0x047eff3e

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8a513493fa82983c983346f55be0330524b67151cda52c0084a9cb4b5a58f0
Instruction ID: 100982626c73dad0cd30856e1b4db7466ee2beb63bc9906718bc0e007a891f68
Opcode Fuzzy Hash: 3c8a513493fa82983c983346f55be0330524b67151cda52c0084a9cb4b5a58f0
Instruction Fuzzy Hash: F1018471E01208ABDB14DBA9D849FAFBBB8EF45704F404066F900EB391EA74EA01C794

Uniqueness

Uniqueness Score: -1.00%

Function 04808ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04808ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0x482d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E04757D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E0477B640(E04779AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x04808ed6
0x04808ee5
0x04808eed
0x04808ef0
0x04808efa
0x04808f03
0x04808f0c
0x04808f15
0x04808f24
0x04808f27
0x04808f31
0x04808f43
0x04808f33
0x04808f3c
0x04808f3c
0x04808f4e
0x04808f4f
0x04808f51
0x04808f56
0x04808f69

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66d80d8d157408763627e87693e40ca6bf4a15d6889797db362832b66afd73ac
Instruction ID: e11677a08d525044611cc2fa352a9ebd8c8843aad7938a6d722eed7c68a2f868
Opcode Fuzzy Hash: 66d80d8d157408763627e87693e40ca6bf4a15d6889797db362832b66afd73ac
Instruction Fuzzy Hash: A1110071A012099FDB44DFA8D545AAEB7F4FB08304F5442A6E918EB381E634A940CB90

Uniqueness

Uniqueness Score: -1.00%

Function 04808A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04808A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0x482d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E04757D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0477B640(E04779AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x04808a62
0x04808a71
0x04808a79
0x04808a82
0x04808a85
0x04808a89
0x04808a8c
0x04808a8f
0x04808a92
0x04808a95
0x04808a9f
0x04808ab1
0x04808aa1
0x04808aaa
0x04808aaa
0x04808abc
0x04808abd
0x04808abf
0x04808ac4
0x04808ada

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e303be1c5b1ded3466be86aca2ac1027befdec988f0cb882bdc223363037458
Instruction ID: 05f1c5adf59e97e0fa3cf5ff7142a975b1222ab72041cf3b17573546c0025ca4
Opcode Fuzzy Hash: 1e303be1c5b1ded3466be86aca2ac1027befdec988f0cb882bdc223363037458
Instruction Fuzzy Hash: A20121B1A0121C9FDB04DFA9D9459AEB7B8EF48314F50445AF904E7351E634A940CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0473DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0473DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E0473DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E0473E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L0473E8B0(__ecx, _t14, 0xfff);
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x0473db64
0x0473db66
0x0473db6b
0x0473dbaa
0x0473db71
0x0473db76
0x0473db7a
0x0473dba3
0x0473db7c
0x0473db87
0x0473db8b
0x04794fa1
0x04794fb3
0x04794fb8
0x0473db91
0x0473db96
0x0473db98
0x0473db98
0x0473db8b
0x0473db7a
0x0473db9d
0x0473dba2

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 4f1329c8641039b307c065287177ca7d31274f7c273f44d5dd53d68c5e5bfe9c
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 8EF046332046239FE3332A568884F2BB69A9FC1A62F160075F1049B345CB70AC0292E0

Uniqueness

Uniqueness Score: -1.00%

Function 0473B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0473B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E04757D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E04757D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E047B7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x0473b1e8
0x0473b1ea
0x0473b1f3
0x04794a17
0x0473b1f9
0x0473b1f9
0x0473b1f9
0x0473b201
0x04794a21
0x04794a2e
0x00000000
0x00000000
0x04794a3b
0x04794a4d
0x04794a3d
0x04794a46
0x04794a46
0x04794a55
0x00000000
0x00000000
0x00000000
0x0473b20a
0x0473b20a
0x0473b20a
0x0473b20a

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 73ab85f2256a500da52b208a72483e5d9e3fdf83d4916d2f26f540467e4c5a5d
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: D301D132204A809BD736976AD908F697BD8EF81754F0800A2F9148B7B2E678FC01C215

Uniqueness

Uniqueness Score: -1.00%

Function 047CFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E047CFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0x482d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E04757D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E0477B640(E04779AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x047cfe96
0x047cfe9e
0x047cfea1
0x047cfead
0x047cfeb3
0x047cfeb9
0x047cfec3
0x047cfed5
0x047cfec5
0x047cfece
0x047cfece
0x047cfee0
0x047cfee1
0x047cfee3
0x047cfee8
0x047cfefb

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c572833eab2e6334a3fc2203ab5deae19c0293c0b5494b33ea58bdb286a06e00
Instruction ID: 296f0d2a4f25a20c27f0976831ec3ac072e025c1868f6ba0a50c29fafc204394
Opcode Fuzzy Hash: c572833eab2e6334a3fc2203ab5deae19c0293c0b5494b33ea58bdb286a06e00
Instruction Fuzzy Hash: 1E016270A00208EFDB14DFA8D546A6EB7F4EF04304F54416AE904DB382E635EA01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 047F131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E047F131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x482d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E04757D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E0477B640(E04779AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x047f131b
0x047f132a
0x047f1330
0x047f1336
0x047f133e
0x047f1341
0x047f1344
0x047f134f
0x047f1361
0x047f1351
0x047f135a
0x047f135a
0x047f136c
0x047f136d
0x047f136f
0x047f1374
0x047f1387

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60f89728ada506921db872dac202c55e19e971d5f131c9e6f019f54f6f7c5b3
Instruction ID: 105b120a27338c48739c14545252870b05feca6fd415082e8892b6eaeca206dd
Opcode Fuzzy Hash: f60f89728ada506921db872dac202c55e19e971d5f131c9e6f019f54f6f7c5b3
Instruction Fuzzy Hash: 39013171A01208EFDB04EFA9D549AAEB7F4FF08700F504059B945EB351E674AA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 04808F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E04808F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0x482d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E04757D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E0477B640(E04779AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x04808f6a
0x04808f79
0x04808f81
0x04808f84
0x04808f8b
0x04808f91
0x04808f94
0x04808f9e
0x04808fb0
0x04808fa0
0x04808fa9
0x04808fa9
0x04808fbb
0x04808fbc
0x04808fbe
0x04808fc3
0x04808fd6

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c7cb6073f4fcbe4dccf76ad9e6de7e7050398e419a9b78770eab9fb0ca9b5cf
Instruction ID: 5ae09de7fff5ea65638e276e540d0a61080e54f43f180daf9ba15607ebdedb5e
Opcode Fuzzy Hash: 8c7cb6073f4fcbe4dccf76ad9e6de7e7050398e419a9b78770eab9fb0ca9b5cf
Instruction Fuzzy Hash: 8D014474A0120CAFDB04EFB8D545AAEB7F4EF08304F508459B905EB380EA74EA00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 047F1608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E047F1608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0x482d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E04757D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E0477B640(E04779AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x047f1608
0x047f1617
0x047f161d
0x047f1625
0x047f1628
0x047f162b
0x047f1636
0x047f1648
0x047f1638
0x047f1641
0x047f1641
0x047f1653
0x047f1654
0x047f1656
0x047f165b
0x047f166e

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf7ee33c5a1ce963666b39d58f52b0f624043e9c48d4a9556c797e517042b544
Instruction ID: 46ba7d7dd23cfcd21ebe6e68d2a9545bd9d775933ebc0201fd5e7f2ecce7d004
Opcode Fuzzy Hash: bf7ee33c5a1ce963666b39d58f52b0f624043e9c48d4a9556c797e517042b544
Instruction Fuzzy Hash: 5DF06271E05248EFDB14EFA9D949A6EB7F4EF04300F444069AA05EB391EA34AD00CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0475C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0475C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E0475C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0x47111cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E048088F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x0475c577
0x0475c57d
0x0475c581
0x0475c5b5
0x0475c5b9
0x0475c5ce
0x0475c5ce
0x0475c5ca
0x00000000
0x0475c5ca
0x0475c5c4
0x0475c5c8
0x00000000
0x00000000
0x00000000
0x0475c5ad
0x00000000
0x0475c5af

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31fd82b86822edebdcda08327ed9f51ecb6cd18677b64a40c6a4eac4a70bbaea
Instruction ID: 05df5d3d233f222deeb3ce06849d58a0ea6466ec79ef304ecfbf54551d18f17d
Opcode Fuzzy Hash: 31fd82b86822edebdcda08327ed9f51ecb6cd18677b64a40c6a4eac4a70bbaea
Instruction Fuzzy Hash: 53F090B29257909EE7339B988004B227BD49B05778F648466DC16AF371C6E4FC80C251

Uniqueness

Uniqueness Score: -1.00%

Function 047F2073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E047F2073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E047EFD22(__ecx);
				_t19 =  *0x482849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0x4828748; // 0x0
					if(__eflags <= 0) {
						E047F1C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0x4828724 & 0x00000004;
							if(( *0x4828724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0x4828724; // 0x0
					return E047E8DF1(__ebx, 0xc0000374, 0x4825890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x047f2076
0x047f2078
0x047f207d
0x047f2083
0x047f20a4
0x047f20aa
0x047f20ac
0x047f20b7
0x047f20ba
0x047f20bc
0x047f20c9
0x047f20c9
0x047f20d0
0x047f20d2
0x00000000
0x047f20d2
0x047f20be
0x047f20c3
0x047f20c5
0x047f20c7
0x00000000
0x00000000
0x047f20c7
0x047f20bc
0x047f20d4
0x047f2085
0x047f2085
0x047f20a3
0x047f20a3

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7f49f2ab218d51ee81cf89c2c885cba055d2cca90e804e1d03e094ff7b8bdd8
Instruction ID: 428a2e54516af3b2062b4fdf18b053c05df239c47ddd397496df3905c9ead21a
Opcode Fuzzy Hash: b7f49f2ab218d51ee81cf89c2c885cba055d2cca90e804e1d03e094ff7b8bdd8
Instruction Fuzzy Hash: E1F0A7274151944BFF32BF257A152E16BD0D749114F494DC6DA9057306C93FED83CA20

Uniqueness

Uniqueness Score: -1.00%

Function 04808D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E04808D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0x482d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E04757D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E0477B640(E04779AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x04808d34
0x04808d43
0x04808d4b
0x04808d4e
0x04808d52
0x04808d5c
0x04808d6e
0x04808d5e
0x04808d67
0x04808d67
0x04808d79
0x04808d7a
0x04808d7c
0x04808d81
0x04808d94

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 526be4e237347d270f8f8211324a529182937d3faa48c36c1511ab73a34c0d56
Instruction ID: b0cfb7d180c4b96df71c4637e80dcf357efd5dbd5bac171c7affb022cf8a2a27
Opcode Fuzzy Hash: 526be4e237347d270f8f8211324a529182937d3faa48c36c1511ab73a34c0d56
Instruction Fuzzy Hash: 51F0B470E0460C9FDB14EFB8D545A6EB7B4EF04304F508599E905EB390EA34E900C754

Uniqueness

Uniqueness Score: -1.00%

Function 0477927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E0477927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E0477FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E047792C6(_t11, _t14);
				}
				return _t11;
			}

0x04779295
0x04779299
0x0477929f
0x047792aa
0x047792ad
0x047792ae
0x047792af
0x047792b0
0x047792b4
0x047792bb
0x047792bb
0x047792c5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 2fce93d774d797be04066ea62a52bd1d34333f8848df49896edc52f9cfc52226
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: D4E0E5722416002BFB21AE05CC84B033669DF82724F004078FA001E342C6E6E80887A0

Uniqueness

Uniqueness Score: -1.00%

Function 0475746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0475746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E0474EB70(__ecx, 0x48279a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E047795D0();
							L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x0475746d
0x0475746d
0x0475746d
0x04757471
0x04757488
0x0479f92d
0x0475748e
0x04757491
0x04757495
0x0479f937
0x0479f93a
0x0479f94e
0x0479f953
0x0479f956
0x0479f956
0x04757495
0x00000000
0x04757488
0x04757473
0x04757478
0x0475747d
0x04757481
0x00000000
0x04757481
0x0475747d
0x0475747a
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34541d71cacb0975ce4a9d0c9f3be27cfb1a6fa7836413398d5c6f63b408abfe
Instruction ID: d1d69f4104060622cdd1bd9f0869921ea3df1d40edcc6307fa23dc74c855c30e
Opcode Fuzzy Hash: 34541d71cacb0975ce4a9d0c9f3be27cfb1a6fa7836413398d5c6f63b408abfe
Instruction Fuzzy Hash: 93F0BE34A00244AAEF099B68C840B79BFB1AF04328F040619DC61EF371F7A8B802CBC5

Uniqueness

Uniqueness Score: -1.00%

Function 04808CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04808CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x482d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E04757D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0477B640(E04779AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04808ce5
0x04808ced
0x04808cf0
0x04808cfb
0x04808d0d
0x04808cfd
0x04808d06
0x04808d06
0x04808d18
0x04808d19
0x04808d1b
0x04808d20
0x04808d33

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56303bf4ea72e16f878d2f9de366d45e0e1d5ad6cb24ab40a0dc924a241ad76f
Instruction ID: c152e5d48bbb21881e9170425cd659c074dd21aa793c7074a0de0cc7190c9819
Opcode Fuzzy Hash: 56303bf4ea72e16f878d2f9de366d45e0e1d5ad6cb24ab40a0dc924a241ad76f
Instruction Fuzzy Hash: 26F08270A05208AFDF04EBA8D94AE6E77B4EF08304F504699E915EB3D0EA34E900C754

Uniqueness

Uniqueness Score: -1.00%

Function 04734F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04734F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E048088F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E0475C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0x4711030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x04734f2e
0x04734f34
0x04734f38
0x04790b85
0x04790b85
0x04790b89
0x04790b9a
0x04790b9a
0x04790b9f
0x00000000
0x04790b9f
0x04790b94
0x04790b98
0x00000000
0x00000000
0x00000000
0x04790b98
0x04734f3e
0x04734f48
0x00000000
0x04734f6e
0x00000000
0x04734f70

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5939413ace48fc362a7c99b23e270a8a9cfbccd081fbf3123edf6dba3847bc8
Instruction ID: d35c5cf8d731950f01fdd84f1d20f21e352672258673f2b79d0d3fb3221df8ba
Opcode Fuzzy Hash: e5939413ace48fc362a7c99b23e270a8a9cfbccd081fbf3123edf6dba3847bc8
Instruction Fuzzy Hash: 43F0E2329316D48FEB71DB18D944B22B7E4EB047B8F444478D815CBB21C764FC80C640

Uniqueness

Uniqueness Score: -1.00%

Function 04808B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E04808B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0x482d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E04757D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E0477B640(E04779AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x04808b67
0x04808b6f
0x04808b72
0x04808b7d
0x04808b8f
0x04808b7f
0x04808b88
0x04808b88
0x04808b9a
0x04808b9b
0x04808b9d
0x04808ba2
0x04808bb5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8f16a772608f9214f90ac2597ce585274fd31c18813012a3bf6ef56fa2497b0
Instruction ID: 86d25280d35895f03026a3cfc194f129e27fdb9a5cd938388b899217152a1eb2
Opcode Fuzzy Hash: f8f16a772608f9214f90ac2597ce585274fd31c18813012a3bf6ef56fa2497b0
Instruction Fuzzy Hash: DBF0E2B0A11208ABEB10EBA8D90AE7EB3B4EF04304F400459BA01DB3C0FA34E900C798

Uniqueness

Uniqueness Score: -1.00%

Function 0476A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0476A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0x4827b9c; // 0x0
				_t15 = __ecx;
				_t16 = L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E0477FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x0476a44b
0x0476a453
0x0476a472
0x0476a476
0x00000000
0x0476a493
0x0476a47a
0x0476a47f
0x0476a486
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bddf1fef9303ebcff5364343dd13ec2c5022676cf8fa0c6fc61cad274fe7e865
Instruction ID: 03cd87f456ca50a0c4815b3540772eb58fa8e5c87e3b245426cb2955919e834b
Opcode Fuzzy Hash: bddf1fef9303ebcff5364343dd13ec2c5022676cf8fa0c6fc61cad274fe7e865
Instruction Fuzzy Hash: 05E09272A01421ABD2215B19AC00F66B79EDBD5655F0A4435ED05D7310D669ED01C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0473F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0473F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E0476F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L04754620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x0473f35d
0x0473f361
0x0473f367
0x0473f372
0x0473f38c
0x0473f38c
0x0473f394

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: d11760ae7a119b2ed10ec4b75e8660a150ca06db866f46631507cdc8ee4b5f83
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: FCE06832A01118BBDB3096CD9D05F5ABBACDB44BA1F000051FD04D7250C464AD40C2C1

Uniqueness

Uniqueness Score: -1.00%

Function 0474FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0474FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0x47111a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E048088F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E04750050(_t14);
				}
			}

0x0474ff66
0x0474ff6b
0x00000000
0x0474ff8f
0x00000000
0x0474ff8f

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c00fc041b0496a7107d6ad10745a283dc0772cfe5c1c7b378b6daa725cf4eb
Instruction ID: 21c4716b2a30b2d9deccc438a9d73c273860834fdc2cdebc69780317c5d7902d
Opcode Fuzzy Hash: 97c00fc041b0496a7107d6ad10745a283dc0772cfe5c1c7b378b6daa725cf4eb
Instruction Fuzzy Hash: 3CE0DFB02052449FE734DB56D040F3677989B83725F19841DE4084BB02C721F880D226

Uniqueness

Uniqueness Score: -1.00%

Function 047C41E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E047C41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0x48108f0);
				_t5 = E0478D08C(__ebx, __edi, __esi);
				if( *0x48287ec == 0) {
					E0474EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0x48287ec == 0) {
						 *0x48287f0 = 0x48287ec;
						 *0x48287ec = 0x48287ec;
						 *0x48287e8 = 0x48287e4;
						 *0x48287e4 = 0x48287e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L047C4248();
				}
				return E0478D0D1(_t5);
			}

0x047c41e8
0x047c41ea
0x047c41ef
0x047c41fb
0x047c4206
0x047c420b
0x047c4216
0x047c421d
0x047c4222
0x047c422c
0x047c4231
0x047c4231
0x047c4236
0x047c423d
0x047c423d
0x047c4247

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84cb7397d748c943293a8fc2ab42621909e825a2ae70d206ec2f4ba89c10686b
Instruction ID: a110a1a31da78d7aab24f2d80123020f5788386602543ea4fae40d7def9cfe12
Opcode Fuzzy Hash: 84cb7397d748c943293a8fc2ab42621909e825a2ae70d206ec2f4ba89c10686b
Instruction Fuzzy Hash: 7AF0F2748507009FFFB1FFAAAB1971436A4F744329F808B2E910086784C739A985CF01

Uniqueness

Uniqueness Score: -1.00%

Function 047ED380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E047ED380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L0473E8B0(__ecx, _a4, 0xfff);
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x047ed38a
0x047ed39b
0x047ed3b1
0x00000000
0x047ed3b6
0x00000000

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: 5758cb6cbab1e5600868f83bc2f2d27901b93a2fc495aebfc177ede5f2389aa1
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 02E0C231284205FBEB325E49CC00FB9BB1ADB447A5F104031FE085EBA0C675BC91E6C4

Uniqueness

Uniqueness Score: -1.00%

Function 0476A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0476A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0x48267e4 >= 0xa) {
					if(_t5 < 0x4826800 || _t5 >= 0x4826900) {
						return L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E04750010(0x48267e0, _t5);
				}
			}

0x0476a190
0x0476a1a6
0x0476a1c2
0x00000000
0x00000000
0x00000000
0x0476a192
0x0476a192
0x0476a19f
0x0476a19f

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9923c25f37baf7804739d7dc8ce65fe29f8096948044564c60f8b61259fdc1fe
Instruction ID: 2a74c93676354ccf0829a7c9c8b9f62526173817bc4e33fe23d2a4f18bb915f9
Opcode Fuzzy Hash: 9923c25f37baf7804739d7dc8ce65fe29f8096948044564c60f8b61259fdc1fe
Instruction Fuzzy Hash: C5D0C7311200901BF62D2700BA18B222263E784708F204E0CEA07BABA1FAA0FCD89508

Uniqueness

Uniqueness Score: -1.00%

Function 047616E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E047616E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E04761710(0x48267e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L04754620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x047616e8
0x047616ef
0x047616f3
0x047616fe
0x00000000
0x04761700
0x0476170d
0x0476170d
0x047616f2
0x047616f2
0x047616f2
0x047616f2

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f38d9d470a19bd7728cca830f7de69d1691cdc1893c836f4fd7b0437c540e018
Instruction ID: f0b48f4eac0d16593da3b91e6a381f00709e742085b0afd83a9d6501e9cb23ae
Opcode Fuzzy Hash: f38d9d470a19bd7728cca830f7de69d1691cdc1893c836f4fd7b0437c540e018
Instruction Fuzzy Hash: 69D0A7711001405AFA2D5B10980CB142257DB80789F7C005CFA07996D0CFA1FCE2E448

Uniqueness

Uniqueness Score: -1.00%

Function 047B53CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E047B53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E0474EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x047b53ca
0x047b53ce
0x047b53d9
0x047b53de
0x047b53e1
0x047b53e1
0x047b53e6
0x047b53f3
0x00000000
0x047b53f8
0x047b53fb

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: a310759d893783b2fab3d86264f5f0780b5a621b3d3f667f26df572aa4af0e9b
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: F1E08C31900780ABCF12EB88C654F9EB7F9FB84B08F140414A4085F720C674BC00CB40

Uniqueness

Uniqueness Score: -1.00%

Function 047635A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E047635A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E0474EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x047635a1
0x047635a1
0x047635a5
0x047635ab
0x047635ab
0x047635b5
0x00000000
0x047635c1
0x047635b7

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: c3b74605eb19c8273c3c04bb5dd07cf9d95dfbce4aaf30e2e7bd310ad0b7715e
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 2CD0C9315515859AEB51AB74C238B6877B3BB40318F5820659C4727B53C33A6A5AD601

Uniqueness

Uniqueness Score: -1.00%

Function 0474AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0474AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x0474aab6
0x0474aabb
0x0479a442
0x00000000
0x0479a448
0x0479a454
0x0479a454
0x0474aac1
0x0474aac1
0x0474aac6
0x0474aac6

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 36c3d8493423b1aed07769297e45efbc2191ec30a52ade3eff3ade14b5b19545
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 5BD0E935352980CFD726CF1DC958B1573A4BB44B84FC50490E501CBB61E72CED44CA00

Uniqueness

Uniqueness Score: -1.00%

Function 047BA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E047BA537(intOrPtr _a4, intOrPtr _a8) {

				return L04758E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x047ba553

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: a6d5b0924350d2f3d1723cbca5880b4310ca92e6081fdb4f38eadd21ef121323
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: 19C01232080248BBCB126E81CC00F067B2AEB94B60F018010BA080A6708672E970EA84

Uniqueness

Uniqueness Score: -1.00%

Function 0473DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0473DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L04754620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x0473db4d
0x0473db54
0x0473db5f
0x0473db56
0x0473db56
0x0473db5c
0x0473db5c

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: 00bb5503519f8d2834a7b79247f86cfdbfd88cd261d3917a7f3fd76dea11ae3a
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: BFC08C70280A00AAEB321F20CD01B0036A1BB00B46F4400A06701DA0F0DBB9EC01EA00

Uniqueness

Uniqueness Score: -1.00%

Function 0473AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0473AD30(intOrPtr _a4) {

				return L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x0473ad49

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 09a6895c3753db636cffc26b126276bba7c00c88a8f31e8ad9b749f1d1e4cefb
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: 48C08C32080248BBC7126A45DD00F017F2DE790B60F000020BA040A6718972E861D588

Uniqueness

Uniqueness Score: -1.00%

Function 04753A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04753A1C(intOrPtr _a4) {
				void* _t5;

				return L04754620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x04753a35

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: 476bc645478875db1982b73e8079a460b375be46f5dd9eef40a39d754a63ed4a
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 5EC08C32080248BBC7126F41DC00F017B29E790B60F000020BA040A6708572ECA0D988

Uniqueness

Uniqueness Score: -1.00%

Function 047476E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E047476E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L047577F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x047476e4
0x00000000
0x047476f8
0x047476fd

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: 00cb8676581fe04781a08430c4acb6be34d8092f81a4aa065067da58fb174b03
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: C6C08C701411805AEB2E6B08CE24B303A55AB48708F48019CEA010D6B1C3A8B803C208

Uniqueness

Uniqueness Score: -1.00%

Function 047636CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E047636CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L04754620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x047636d2
0x047636e8
0x047636d4
0x047636e5
0x047636e5

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: 3dbbd45eb6deaac54bfa2c9637d49f06b16ac8f5016fe81aa160af02708b29f8
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 46C02B70158440FBE7151F30CD00F147254F700A21F64035477224D6F0D56ABC00D500

Uniqueness

Uniqueness Score: -1.00%

Function 04757D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04757D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x04757d56
0x04757d5b
0x04757d60
0x04757d5d
0x04757d5d
0x04757d5d

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: c4def13bd455edf57bba66dc13c4c0d9b55576388e6fb069913ebd3344fef76c
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: 11B09234301A408FCF2ADF18C080B1533E4BB44A40F8400D0E800CBA20D229E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 04762ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04762ACB() {
				void* _t5;

				return E0474EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x04762adc

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: bf20a6316271edb14a0d28a94c771baf2cd66828b1497bc07e04bfcaef7b23b3
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: A0B01232C10840CFCF02EF84C610F297331FB40760F0544A0900127A30C328BC01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0477B040, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8019063812ddd041bc913cd6f4e72551795c8c490c7b4146aba195f64bcfc152
Instruction ID: 405ebbd7456e2574edc2a2a0eaeb7ed3a6b636549c9c66c771d6e7018aa956d4
Opcode Fuzzy Hash: 8019063812ddd041bc913cd6f4e72551795c8c490c7b4146aba195f64bcfc152
Instruction Fuzzy Hash: 389002B1641140476550B15988048065015A7F5345391C135E0445574C86A8D859B2A5

Uniqueness

Uniqueness Score: -1.00%

Function 04779840, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052c9d9e48669c52b1db094dca336106c5b2d81c5fe9bf00dda5ad79a2cc27b5
Instruction ID: e9182d5674df18e909ebbbe354946ca3a1ddf629a08fb0611876639156d16006
Opcode Fuzzy Hash: 052c9d9e48669c52b1db094dca336106c5b2d81c5fe9bf00dda5ad79a2cc27b5
Instruction Fuzzy Hash: E8900271282041567555B15984049074006A7F4285791C026E1405964C8566E85AF661

Uniqueness

Uniqueness Score: -1.00%

Function 04779820, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf33bcf2af31a00c05ee9507b883c028ce12f03a49c49872aab8cec9433fa56
Instruction ID: 2cbab792c35d1fa2a3e9ce024ac8a7089fae3f4e6d9d6a32192506fa7544fc9d
Opcode Fuzzy Hash: faf33bcf2af31a00c05ee9507b883c028ce12f03a49c49872aab8cec9433fa56
Instruction Fuzzy Hash: D690027128100406F15171598404A060009A7E4285F91C026E0415568E8695DA5ABAA1

Uniqueness

Uniqueness Score: -1.00%

Function 047798F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f69dac70605a5ef2d5b417ebeb0ebc2764afb19b1d8a3387a0d73b2e1898b4da
Instruction ID: 3071fc7b5482562c219e26552c607df0fb2f08dd5524703ca50120159e52f940
Opcode Fuzzy Hash: f69dac70605a5ef2d5b417ebeb0ebc2764afb19b1d8a3387a0d73b2e1898b4da
Instruction Fuzzy Hash: 1A90027164100506F11171598404A16000A97E4285F91C036E1015569ECA65D996B171

Uniqueness

Uniqueness Score: -1.00%

Function 047798A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17c2e7fd4aeb82e1a575b647495b67e47c2a743bec9ef8cbcdce63726f53523a
Instruction ID: fabdcdc0e587b1185851e3ec8bb5017c5450dce7b72332e1007809ab6a19b314
Opcode Fuzzy Hash: 17c2e7fd4aeb82e1a575b647495b67e47c2a743bec9ef8cbcdce63726f53523a
Instruction Fuzzy Hash: 6C90027134100406F11271598414A060009D7E5389F91C026E1415569D8665D957B172

Uniqueness

Uniqueness Score: -1.00%

Function 04779560, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 845e621452dcd869f73994eca4cba95ee5d86255b4a7c73a6dc31246b70fab2b
Instruction ID: 86e8187b62bbdad1622b6801d611115af3c0452cec1a50f84b32faea440b2084
Opcode Fuzzy Hash: 845e621452dcd869f73994eca4cba95ee5d86255b4a7c73a6dc31246b70fab2b
Instruction Fuzzy Hash: 8E900275261000062155B559460490B0445A7EA395391C029F14075A4CC661D8697361

Uniqueness

Uniqueness Score: -1.00%

Function 04779950, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 312e9d197ac8cdbd3ebdd9cc3774bac581fa77cd8e70f3eec30e90fb78524823
Instruction ID: ab21c1965b785b2f5e3252d16c6f1eab85b23e2cd76fba1784fa478055efe73c
Opcode Fuzzy Hash: 312e9d197ac8cdbd3ebdd9cc3774bac581fa77cd8e70f3eec30e90fb78524823
Instruction Fuzzy Hash: 659002B124140407F15075598804A07000597E4346F51C025E2055569E8A69DC557175

Uniqueness

Uniqueness Score: -1.00%

Function 04779540, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a23e7bfd24764abea7aef1b5907ad3907d23d2ad6cdc44de16ac624d6eed54a
Instruction ID: 014803386cd8810602c251efe0935cf1a4baac3dcc5d38263e231dc1db4d369a
Opcode Fuzzy Hash: 4a23e7bfd24764abea7aef1b5907ad3907d23d2ad6cdc44de16ac624d6eed54a
Instruction Fuzzy Hash: AC900275251000072115B5594704907004697E9395351C035F1006564CD661D8657161

Uniqueness

Uniqueness Score: -1.00%

Function 0477AD30, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c7f5a41b8076eb30230cca605510a25989c74471a8b56fab7fdb0bdfb1a65bc
Instruction ID: 318bb07358960fdb9db4e69f0ed651707ba731c5e2d50ba27f3b41fe4e32a243
Opcode Fuzzy Hash: 0c7f5a41b8076eb30230cca605510a25989c74471a8b56fab7fdb0bdfb1a65bc
Instruction Fuzzy Hash: B6900271A4500016B15071598814A464006A7F4785B55C025E0505568C8994DA5973E1

Uniqueness

Uniqueness Score: -1.00%

Function 04779520, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adfcd8722d1e16f1808c892e1266d087a79ee4413c94a95c8f7116cbe3c9f590
Instruction ID: c8a885fe2a4b40e4a0a8025bc6deee13ff4d386479801c0ab91072641c341e2c
Opcode Fuzzy Hash: adfcd8722d1e16f1808c892e1266d087a79ee4413c94a95c8f7116cbe3c9f590
Instruction Fuzzy Hash: 729002F1241140966510B259C404F0A450597F4245B51C02AE1045574CC565D855B175

Uniqueness

Uniqueness Score: -1.00%

Function 04779910, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478bcfdae1b57f3de11369c92c438c8d5993098611d7834981c84dee63299966
Instruction ID: 74aa8e86e2f7bb37929717a47a70ff237d1053beaa36617bd96d71a4dd707d8a
Opcode Fuzzy Hash: 478bcfdae1b57f3de11369c92c438c8d5993098611d7834981c84dee63299966
Instruction Fuzzy Hash: E09002B124100406F15071598404B46000597E4345F51C025E5055568E8699DDD976A5

Uniqueness

Uniqueness Score: -1.00%

Function 047795F0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d835ffb91b0403a8eb7c67693a331d4a6c5c340fba33aa7c65d825624aa2b6
Instruction ID: 90b5173b50070ceeca1fb7cf9713fd0381c3dc403d7c4b1499dcbf0e1b9c76f0
Opcode Fuzzy Hash: 30d835ffb91b0403a8eb7c67693a331d4a6c5c340fba33aa7c65d825624aa2b6
Instruction Fuzzy Hash: 1B90027124100806F11471598804A86000597E4345F51C025E6015669E96A5D8957171

Uniqueness

Uniqueness Score: -1.00%

Function 047799D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef4a586eb48642249b099f2501e86f3c17dd0e99eee4437e57a968e03ddd9e7
Instruction ID: b0712e18a514f9dfba04dda0592b1356b57d873e6157bc706a8c24a09ef9bcc6
Opcode Fuzzy Hash: 1ef4a586eb48642249b099f2501e86f3c17dd0e99eee4437e57a968e03ddd9e7
Instruction Fuzzy Hash: F99002B125100046F11471598404B06004597F5245F51C026E2145568CC569DC657165

Uniqueness

Uniqueness Score: -1.00%

Function 047795D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c1fccf4d08f655f4b984e910c3469de88d498ce1230809278a7bc2351e744ca
Instruction ID: 0285e9a219eecfcee0d3d06970f113eedea83386e4e323b86394dc11226a7b31
Opcode Fuzzy Hash: 5c1fccf4d08f655f4b984e910c3469de88d498ce1230809278a7bc2351e744ca
Instruction Fuzzy Hash: 4D9002B124200007611571598414A16400A97F4245B51C035E10055A4DC565D8957165

Uniqueness

Uniqueness Score: -1.00%

Function 047799A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3164e1acd64d050efa56df02e126c996f7025b9ba590d28258a871f74d7c9367
Instruction ID: 6eb0536df7aa76879015fc4e4c51f8e867ee5c2c6263e31910def88e0237a7e6
Opcode Fuzzy Hash: 3164e1acd64d050efa56df02e126c996f7025b9ba590d28258a871f74d7c9367
Instruction Fuzzy Hash: DB9002B138100446F11071598414F060005D7F5345F51C029E1055568D8659DC567166

Uniqueness

Uniqueness Score: -1.00%

Function 04779A50, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6511ed7942e651bbf6f9128f594b8f2b548ba181a5b8f66c1fc05159fa31484b
Instruction ID: da1b5b1533e02d3d9bfbded9e282c543c35d2a227b6d9b7ee6d109a17ad8b6ea
Opcode Fuzzy Hash: 6511ed7942e651bbf6f9128f594b8f2b548ba181a5b8f66c1fc05159fa31484b
Instruction Fuzzy Hash: EB90027125180046F21075698C14F07000597E4347F51C129E0145568CC955D8657561

Uniqueness

Uniqueness Score: -1.00%

Function 04779650, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5630d5d60942fa2f3e54c4d65e820debb29c65710ab39171ed9fc58d2ba97a16
Instruction ID: d3fe303099351703a85c377f53a3ef3396e372accd24bd13159cce221aaaee8f
Opcode Fuzzy Hash: 5630d5d60942fa2f3e54c4d65e820debb29c65710ab39171ed9fc58d2ba97a16
Instruction Fuzzy Hash: 7B90027124504846F15071598404E46001597E4349F51C025E00556A8D9665DD59B6A1

Uniqueness

Uniqueness Score: -1.00%

Function 04779A20, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03ca63cb3b01a4732893659374148ad2514e47de776988b7a544008998b8ca8b
Instruction ID: 1255b1e930d0a02084afca602eaff172b1787e8b537334f41b0003e0a184271c
Opcode Fuzzy Hash: 03ca63cb3b01a4732893659374148ad2514e47de776988b7a544008998b8ca8b
Instruction Fuzzy Hash: F19002716410004661507169C844D064005BBF5255751C135E0989564D8599D86976A5

Uniqueness

Uniqueness Score: -1.00%

Function 04779610, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55d4e30fcdfcd97e5f928ca9935b9651ea4fb6f92af8b141a59ff13d27e01b93
Instruction ID: 27fea9ee246dad35a45ee728e7d6a4f12755a6035ab8d5897c4a707192fdf838
Opcode Fuzzy Hash: 55d4e30fcdfcd97e5f928ca9935b9651ea4fb6f92af8b141a59ff13d27e01b93
Instruction Fuzzy Hash: 3E90027164500806F16071598414B46000597E4345F51C025E0015668D8795DA5976E1

Uniqueness

Uniqueness Score: -1.00%

Function 04779A10, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89264769deffb333362fcf90123d324f9209dbc71a3479a75b0f5e947f1160be
Instruction ID: fe318d57f637263f5ccd77e7cf7c346e30a085ecc8f7a1833c981fd087bd0f16
Opcode Fuzzy Hash: 89264769deffb333362fcf90123d324f9209dbc71a3479a75b0f5e947f1160be
Instruction Fuzzy Hash: 2790027124140406F11071598808B47000597E4346F51C025E5155569E86A5D8957571

Uniqueness

Uniqueness Score: -1.00%

Function 04779A00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e2399a1581305b983ba66a223beae4631fb523aac6a190d02f30fc771e1b680
Instruction ID: 06177c18c94584de65f765338dc57421e9b3c099dd30d8224bc952d95d8fbfdc
Opcode Fuzzy Hash: 4e2399a1581305b983ba66a223beae4631fb523aac6a190d02f30fc771e1b680
Instruction Fuzzy Hash: 2090027124140406F11071598814B0B000597E4346F51C025E1155569D8665D85575B1

Uniqueness

Uniqueness Score: -1.00%

Function 047796D0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01cbd6c8c5e313c32d83c2343519da955aa59c3bae9be84b85ee44f2cb9fead5
Instruction ID: 81c3fc9cf431b443248c8f45a049a5a1c52b15b03f8d4c4df705f79ba51fb8c5
Opcode Fuzzy Hash: 01cbd6c8c5e313c32d83c2343519da955aa59c3bae9be84b85ee44f2cb9fead5
Instruction Fuzzy Hash: 7D90027124100846F11071598404F46000597F4345F51C02AE0115668D8655D8557561

Uniqueness

Uniqueness Score: -1.00%

Function 04779A80, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafd6649f387da07ae32558f9b3f7c11350254290d12ecca1b8fba489d0dbcd0
Instruction ID: dc15235e642c0028dc4194f0e8a0596d8b11f4937ca7accdd21ee434a5c8a947
Opcode Fuzzy Hash: aafd6649f387da07ae32558f9b3f7c11350254290d12ecca1b8fba489d0dbcd0
Instruction Fuzzy Hash: 7390027124144446F15072598804F0F410597F5246F91C02DE4147568CC955D8597761

Uniqueness

Uniqueness Score: -1.00%

Function 04779770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23bbe8241166870b5809cd96ecf2fdc35c4b93010e499ae7146750affd0c1940
Instruction ID: aba9358b218aa5a29339ea2af010c220a9715284da3fbec5e0fb40816b881d53
Opcode Fuzzy Hash: 23bbe8241166870b5809cd96ecf2fdc35c4b93010e499ae7146750affd0c1940
Instruction Fuzzy Hash: C690027124504446F11075599408E06000597E4249F51D025E10555A9DC675D855B171

Uniqueness

Uniqueness Score: -1.00%

Function 0477A770, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3814c9b8a46ffac0f4cae88b2520668b087164441b31f55ad11b10ca5ab33796
Instruction ID: e35dfafdbcc5109872f8d3a8cff6f0613c004de484f3691455efbf02477cbd0c
Opcode Fuzzy Hash: 3814c9b8a46ffac0f4cae88b2520668b087164441b31f55ad11b10ca5ab33796
Instruction Fuzzy Hash: B590027524504446F51075599804E87000597E4349F51D425E04155ACD8694D865B161

Uniqueness

Uniqueness Score: -1.00%

Function 04779760, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21d718fb0c907e3c79f446a807e8395b805ab66809e227908282d2d8be27c40b
Instruction ID: 02449a5442c46365351db3e5268a5e0b572019cab274185ac932816b18736464
Opcode Fuzzy Hash: 21d718fb0c907e3c79f446a807e8395b805ab66809e227908282d2d8be27c40b
Instruction Fuzzy Hash: 5090027124100407F11071599508B07000597E4245F51D425E041556CDD696D8557161

Uniqueness

Uniqueness Score: -1.00%

Function 04779730, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64c3ba42a5310b69a12f00a4e3ea43bf9765a0d2a809d9a8844323d0648e5b0e
Instruction ID: e3a737335ef0a96ff4c30bb06854605cd2e3f9ae5039375bbda1fa6db465cdf0
Opcode Fuzzy Hash: 64c3ba42a5310b69a12f00a4e3ea43bf9765a0d2a809d9a8844323d0648e5b0e
Instruction Fuzzy Hash: A590027164500406F15071599418B06001597E4245F51D025E0015568DC699DA5976E1

Uniqueness

Uniqueness Score: -1.00%

Function 0477A710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b1c9126561790ee7b260cca5ee4bffa9950d82a8de360c6ea9ff98fe4549231
Instruction ID: f1b0c767992029b6f37f287755943439f4c680fc83f0a27d13c85ad032fcbae0
Opcode Fuzzy Hash: 4b1c9126561790ee7b260cca5ee4bffa9950d82a8de360c6ea9ff98fe4549231
Instruction Fuzzy Hash: 5F90027134100056B510B6999804E4A410597F4345B51D029E4005568C8594D8657161

Uniqueness

Uniqueness Score: -1.00%

Function 04779710, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e437b734955f5d24fa47e20211b828e02825f25e1e5b823c5920864770ea380
Instruction ID: 0d08fb4d96013d097328c51371e05d333170b4d6e436f6c09bf41ed0021d4fc1
Opcode Fuzzy Hash: 4e437b734955f5d24fa47e20211b828e02825f25e1e5b823c5920864770ea380
Instruction Fuzzy Hash: 9890027124100406F11075999408A46000597F4345F51D025E5015569EC6A5D8957171

Uniqueness

Uniqueness Score: -1.00%

Function 04779B00, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9453cbcecb82aef9fe750f705a545773223f18bf0ae847a33ba45336608d5880
Instruction ID: 5c694997700b566ba3ef920b89aee4c8f38898d7966f994bb6a97702578cc4c0
Opcode Fuzzy Hash: 9453cbcecb82aef9fe750f705a545773223f18bf0ae847a33ba45336608d5880
Instruction Fuzzy Hash: C690027128100806F1507159C414B070006D7E4645F51C025E0015568D8656D96976F1

Uniqueness

Uniqueness Score: -1.00%

Function 04779FE0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247086f47e876b0ab8117d06442d85fd1a306077adaf50de6a5da51ec94a95db
Instruction ID: bdcf523ae27eb52ecf403699949c1880f3aa041d7a75a4a921619b7a5b918841
Opcode Fuzzy Hash: 247086f47e876b0ab8117d06442d85fd1a306077adaf50de6a5da51ec94a95db
Instruction Fuzzy Hash: 6C90027135114406F1207159C404B06000597E5245F51C425E081556CD86D5D8957162

Uniqueness

Uniqueness Score: -1.00%

Function 0477A3B0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de558e41af50d155de6cfb75e86cb769d84ec6b7f03d70729004f3002d835dd0
Instruction ID: cc2a7d5c4316117bbc1c036cda1e39a65244113745be09f5c8fc695ebc7b4160
Opcode Fuzzy Hash: de558e41af50d155de6cfb75e86cb769d84ec6b7f03d70729004f3002d835dd0
Instruction Fuzzy Hash: 5F90027124144006F1507159C444A0B5005A7F4345F51C425E0416568C8655D85AB261

Uniqueness

Uniqueness Score: -1.00%

Function 047797A0, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad3ae4207e086fd5bd542faebbe4979a8b699dfb08d241ec60920a57d04cfa0
Instruction ID: 65f2459aae8d5d564c09f2fa4dd1da551cf7fa51c3cc8c90ffc1e83b50771db6
Opcode Fuzzy Hash: 2ad3ae4207e086fd5bd542faebbe4979a8b699dfb08d241ec60920a57d04cfa0
Instruction Fuzzy Hash: 7A90027134100007F15071599418A064005E7F5345F51D025E0405568CD955D85A7262

Uniqueness

Uniqueness Score: -1.00%

Function 04779780, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49e21176eab3828d2f309e94b59d50702730ad18c6346be78348dbecd7792ec
Instruction ID: b619b6b36c51970f45ae2b25bfcb1fdb726bb728d7f4f3a6b61ad7235f31f14f
Opcode Fuzzy Hash: f49e21176eab3828d2f309e94b59d50702730ad18c6346be78348dbecd7792ec
Instruction Fuzzy Hash: 0890027925300006F19071599408A0A000597E5246F91D429E000656CCC955D86D7361

Uniqueness

Uniqueness Score: -1.00%

Function 04779670, Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 83e62101d784d88cf5ea58b38529311b162f97bccdaf08498c8f73c4cc3a7df6
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 047CFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E047CFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E0477CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E047C5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E047C5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x047cfdda
0x047cfde2
0x047cfde5
0x047cfdec
0x047cfdfa
0x047cfdff
0x047cfe0a
0x047cfe0f
0x047cfe17
0x047cfe1e
0x047cfe19
0x047cfe19
0x047cfe19
0x047cfe20
0x047cfe21
0x047cfe22
0x047cfe25
0x047cfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 047CFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 047CFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 047CFE01

Memory Dump Source

Source File: 00000007.00000002.397047330.0000000004710000.00000040.00000001.sdmp, Offset: 04710000, based on PE: true

Associated: 00000007.00000002.399772437.000000000482B000.00000040.00000001.sdmp Download File
Associated: 00000007.00000002.399786779.000000000482F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 54a316687e86ecc7edbf36e4699af5e4c810fb89568d37206a45fc630c8c40e4
Instruction ID: 46021486248fe692521ec4119820fb3e66fe73dd92f8b430ebebee68d28c9f08
Opcode Fuzzy Hash: 54a316687e86ecc7edbf36e4699af5e4c810fb89568d37206a45fc630c8c40e4
Instruction Fuzzy Hash: 2AF0F672240611BFEA201A55DC0AF23BB5AEB44730F24435CF628562E1EA62F86096F4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report FedEx TRACKING DETAILS.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Function 047F1C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Function 04743D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Function 04768E00, Relevance: 5.1, Strings: 4, Instructions: 126
COMMON

Function 04748794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Function 04747E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Function 0473E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Function 047B51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Function 0473B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Function 0475B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Function 04762581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Function 0476FAB0, Relevance: 1.6, Strings: 1, Instructions: 306
COMMON

Function 04732D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Function 04800EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Function 0476F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Function 047B3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Function 048005AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Function 047B3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Function 0476D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Function 04741B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Function 0475F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Function 047E8DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Function 0473F900, Relevance: .9, Instructions: 863
COMMONCrypto

Function 04805BA5, Relevance: .6, Instructions: 592
COMMON

Function 04756E30, Relevance: .5, Instructions: 481
COMMONCrypto

Function 04754120, Relevance: .4, Instructions: 444
COMMONCrypto

Function 047620A0, Relevance: .4, Instructions: 420
COMMONCrypto

Function 0474B090, Relevance: .4, Instructions: 405
COMMONCrypto

Function 04730D20, Relevance: .4, Instructions: 372
COMMONCrypto

Function 0474D5E0, Relevance: .4, Instructions: 353
COMMONCrypto

Function 0474849B, Relevance: .3, Instructions: 290
COMMON

Function 0476513A, Relevance: .3, Instructions: 258
COMMON

Function 047603E2, Relevance: .3, Instructions: 254
COMMON

Function 0476EBB0, Relevance: .2, Instructions: 250
COMMONCrypto

Function 04801D55, Relevance: .2, Instructions: 226
COMMONCrypto

Function 0473C600, Relevance: .2, Instructions: 225
COMMON

Function 047FDBD2, Relevance: .2, Instructions: 212
COMMONCrypto

Function 047CB8D0, Relevance: .2, Instructions: 199
COMMON

Function 047B6DC9, Relevance: .2, Instructions: 199
COMMON

Function 047F1002, Relevance: .2, Instructions: 198
COMMONCrypto

Function 047352A5, Relevance: .2, Instructions: 161
COMMON

Function 04762AE4, Relevance: .2, Instructions: 159
COMMON

Function 047FAE44, Relevance: .2, Instructions: 152
COMMON

Function 0475DBE9, Relevance: .1, Instructions: 149
COMMON

Function 0474EF40, Relevance: .1, Instructions: 147
COMMON

Function 0480740D, Relevance: .1, Instructions: 141
COMMON

Function 04762990, Relevance: .1, Instructions: 133
COMMON

Function 04764D3B, Relevance: .1, Instructions: 131
COMMON